APRF-10 · Authentication

Purpose

Ensure every actor that can invoke AI capabilities—humans, services, agents, MCP clients—is authenticated with appropriate assurance.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

AUTHN-M1L3 · DefinedTier 2 · ProductionhybridE3
Customer-facing AI HTTP/RPC APIs shall reject callers that present no valid credentials—so anonymous traffic cannot invoke model, tool, retrieval, or other privileged AI surfaces.
Artifact
Production AI HTTP/RPC route catalog + unauthenticated auth-probe report (401/403) matching the catalog
Pass condition
100% of declared production AI HTTP/RPC routes in the probe inventory return 401/403 without credentials; every declared AI route in the production route catalog was probed (measuredAt ≤90 days). If no customer-facing AI HTTP/RPC APIs exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure no production AI endpoint serves an unauthenticated caller.
Threats mitigated
Identity SpoofingDenial of WalletModel TheftData Exfiltration
Protects
APIsIdentityModelsDataCost
MITRE: ATLAS AML.T0040 · ATLAS AML.T0096 · ATLAS AML.T0024 · ATLAS AML.T0024.002 · ATLAS AML.T0034
An unauthenticated inference endpoint hands an adversary the API access that most ATLAS attack chains require first. Requiring authentication removes free model-extraction and cost-harvesting capability and makes remaining abuse attributable to a principal.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHN-M2L3 · DefinedTier 2 · ProductionhybridE3
Production MCP and AI service-to-service connections shall authenticate with a named machine identity—so anonymous access and shared long-lived static keys cannot stand in for workload or federated identity.
Artifact
Production MCP/AI S2S connection inventory + auth config (secrets redacted) + scored report
Pass condition
0 production MCP or AI S2S connections accept anonymous access or shared long-lived static keys; each connection has a named machine identity (measuredAt ≤90 days). If no production MCP or AI S2S connections exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure every service-to-service and MCP connection proves a strong machine identity rather than a shared static secret.
Threats mitigated
Identity SpoofingPrivilege EscalationUnauthorized Tool UseSupply Chain Compromise
Protects
IdentityToolsAPIsNetwork
MITRE: ATLAS AML.T0012 · ATLAS AML.T0073 · ATLAS AML.T0074 · ATLAS AML.T0091 · ATLAS AML.T0091.000 · ATT&CK T1078 · ATT&CK T1550 · ATT&CK T1550.001
Mutual, cryptographically verifiable machine identity stops an attacker from presenting a stolen static token as a legitimate service or MCP server. It closes the valid-accounts and alternate-authentication-material paths between AI components.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHN-M3L3 · DefinedTier 2 · ProductionhybridE3
Administrative access to AI control planes shall require strong authentication including MFA—so operators who can change prompts, tools, models, or deployments cannot rely on password-only or shared credentials.
Artifact
IdP MFA policy export for AI control-plane admin roles + break-glass inventory with monitoring
Pass condition
100% of AI control-plane admin roles enforce MFA; break-glass accounts ≤ documented maximum and have monitoring enabled (measuredAt ≤90 days). If no AI control-plane admin access exists, score NOT_APPLICABLE.
Why this control exists
Threat map
Prevent takeover of AI control planes through compromised administrator credentials.
Threats mitigated
Identity SpoofingPrivilege EscalationInsider MisuseSupply Chain Compromise
Protects
IdentityInfrastructureModelsPromptsRuntime
MITRE: ATLAS AML.T0012 · ATLAS AML.T0081 · ATT&CK T1078 · ATT&CK T1078.004 · ATT&CK T1098 · ATT&CK T1556
Control-plane admin access lets an adversary change model pins, prompts, and agent configuration directly, bypassing every model-layer defence at once. Phishing-resistant MFA denies the valid-accounts path that these techniques depend on.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHN-M4L5 · OptimizingTier 3 · Mission CriticalhybridE3
Where AI systems execute tools, agents, workflows, or delegated actions, the end-user (or documented service) subject shall remain bound through every privileged hop—so agentic chains cannot act as anonymous or ambient privilege.
Artifact
Identity-propagation design + sample traces showing end-user/service subject on privileged tool/agent/workflow calls
Pass condition
100% of sampled privileged tool/agent/workflow calls in the latest review carry an end-user (or documented service) subject; 0 anonymous privileged hops (measuredAt ≤90 days). If the system has no tools, agents, workflows, or delegated actions, score NOT_APPLICABLE.
Why this control exists
Threat map
Preserve the end user's identity through agent and tool hops so downstream authorization is evaluated against the real principal.
Threats mitigated
Privilege EscalationIdentity SpoofingUnauthorized Tool UseData Exfiltration
Protects
IdentityUsersToolsDataExternal Systems
MITRE: ATLAS AML.T0091 · ATLAS AML.T0053 · ATLAS AML.T0086 · ATT&CK T1078 · ATT&CK T1548 · ATT&CK T1550
When an agent collapses to a single service identity, every user inherits the agent's privilege and cross-tenant reads become invisible to downstream checks. Propagating the end-user principal keeps those checks meaningful and prevents confused-deputy escalation through tool chains.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Auth architecture for AI and MCP surfaces
Evidence that anonymous access is disabled in production
Admin access controls documentation

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

AUTHN-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Agent and tool credentials used in production should be short-lived (TTL ≤1h, or a named exception ≤30 days), and production prompts/config should embed 0 long-lived static API keys—so leaked prompts and agent configs cannot mint durable privileged access.
Artifact
Agent/tool credential inventory with TTL/exceptions + secret-scan of prompts/config (0 long-lived static API keys)
Pass condition
100% of inventoried agent/tool credentials have TTL ≤1h (or a named exception with owner and expiry ≤30 days); secret scan of production prompts/config finds 0 long-lived static API keys (measuredAt ≤90 days). If no agent/tool credentials appear in production prompts/config, score NOT_APPLICABLE.
Why this control exists
Threat map
Limit the useful lifetime of agent and tool credentials so leaked material expires quickly.
Threats mitigated
Secret LeakageIdentity SpoofingPrivilege EscalationData Exfiltration
Protects
SecretsIdentityToolsAPIs
MITRE: ATLAS AML.T0055 · ATLAS AML.T0083 · ATLAS AML.T0098 · ATLAS AML.T0082 · ATT&CK T1552 · ATT&CK T1552.001 · ATT&CK T1078
Prompts, agent configuration, and tool definitions are routinely harvested, so any credential placed there should be treated as already disclosed. Short-lived, narrowly scoped tokens shrink the window in which harvested credentials remain usable.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
AUTHN-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Every self-hosted model runtime in production should authenticate via workload identity (SPIFFE, cloud IAM role, or equivalent)—so inference nodes and model servers do not rely on shared static keys.
Artifact
Self-hosted model runtime inventory + workload-identity bindings + sample authenticated call traces (0 static shared keys)
Pass condition
Every self-hosted model runtime in production authenticates via workload identity (SPIFFE/IAM role/equivalent); 0 static shared keys in the runtime inventory; sample authenticated calls (or harness) present (measuredAt ≤90 days). If no self-hosted model runtimes exist, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure self-hosted inference runtimes authenticate as attested workloads rather than with embedded static secrets.
Threats mitigated
Identity SpoofingSecret LeakagePrivilege Escalation
Protects
IdentityInfrastructureModelsRuntime
MITRE: ATLAS AML.T0012 · ATLAS AML.T0055 · ATT&CK T1078 · ATT&CK T1552
Workload identity removes long-lived secrets from inference hosts and binds access to an attested runtime. An attacker who reaches the host therefore cannot lift a static key and reuse it elsewhere.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

AI endpoints are privileged application surfaces. Anonymous or shared credentials for agents and MCP are incompatible with production readiness beyond Level 1.

Why it matters

Unauthenticated model and tool endpoints become public compute and data exfiltration oracles. Agent impersonation enables privilege abuse across systems.

Common failures

Public API keys embedded in clients calling powerful agents
MCP servers listening without auth
Service accounts shared across many agents
No MFA for admin consoles controlling prompts and tools

Severity & risk

Severity: critical; Impact if violated
Risk level: critical; Typical residual risk (impact × likelihood)

Engineering best practices

Prefer OAuth2/OIDC or workload identity over static API keys
Issue distinct identities per agent class
Rotate credentials automatically; detect leaked keys in repos and prompts
Authenticate both directions for A2A where feasible

Automatic validations

Integration tests rejecting unauthenticated calls
Secret scanning for exposed AI API keys
Config checks that MCP auth is enabled

Manual validations

Identity design review for new agent entry points
Periodic access review of AI admin roles

Examples

An MCP server requires OAuth for every client; local-dev uses a distinct non-prod issuer
A voice AI channel authenticates the telephony session before invoking tools

References

Crosswalks

Show 13 peer mappingsexpand

Secure & Resilient Secure and Resilient
NIST AI Risk Management Framework · aligns-with
C5.1 Authentication
OWASP AI Application Security Verification Standard (AISVS) · aligns-with
C5.2 AI Resource Authorization & Classification
OWASP AI Application Security Verification Standard (AISVS) · supports
C5.3 Multi-Tenant Isolation
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.1 Component Integrity
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.2 Authentication & Authorization
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.3 Secure Transport
OWASP AI Application Security Verification Standard (AISVS) · partial
C10.4 Schema, Message, and Input Validation
OWASP AI Application Security Verification Standard (AISVS) · partial
CWE-287 Improper Authentication
OpenCRE (Open Common Requirements Enumeration) · aligns-with
CWE-352 Cross-Site Request Forgery (CSRF)
OpenCRE (Open Common Requirements Enumeration) · partial
CWE-384 Session Fixation
OpenCRE (Open Common Requirements Enumeration) · partial
CC6 Logical and Physical Access
SOC 2 Trust Services Criteria · evidence-for
Security Security
AWS Well-Architected Framework · aligns-with

Future evolution

Standard agent identity profiles and passport-like credentials for cross-org A2A.