Purpose
Ensure every actor that can invoke AI capabilities—humans, services, agents, MCP clients—is authenticated with appropriate assurance.
Engineering philosophy
AI endpoints are privileged application surfaces. Anonymous or shared credentials for agents and MCP are incompatible with production readiness beyond Level 1.
Why it matters
Unauthenticated model and tool endpoints become public compute and data exfiltration oracles. Agent impersonation enables privilege abuse across systems.
Common failures
- Public API keys embedded in clients calling powerful agents
- MCP servers listening without auth
- Service accounts shared across many agents
- No MFA for admin consoles controlling prompts and tools
Mandatory checks
Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.
Customer-facing AI APIs shall reject unauthenticated callers
- Artifact
- Automated auth probe report covering all production AI HTTP/RPC routes
- Pass condition
- 100% of probed production AI endpoints return 401/403 without valid credentials; probe inventory matches production route catalog
Service-to-service and MCP connections shall use strong machine identity
- Artifact
- MCP/S2S connection inventory + auth config export
- Pass condition
- 0 production MCP or AI S2S connections accept anonymous access or shared long-lived static keys; each connection has a named machine identity
Administrative access to AI control planes shall require strong authentication including MFA
- Artifact
- IdP policy export for AI admin roles + break-glass account inventory
- Pass condition
- 100% of AI control-plane admin roles enforce MFA; break-glass accounts ≤ documented maximum and have monitoring enabled
End-user identity shall remain bound through agent and tool chains
- Artifact
- Identity-propagation design + sample traces showing end-user subject on tool calls
- Pass condition
- PASS if 100% of sampled privileged tool calls in the latest review carry an end-user (or documented service) subject; 0 anonymous privileged hops
Recommended checks
Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.
Short-lived tokens for agents and tools; no long-lived static keys in prompts
- Artifact
- IdP/token TTL policy export + inventory of agent/tool credentials used in production prompts/config
- Pass condition
- 100% of inventoried agent/tool credentials have TTL ≤1h (or a named exception ≤30 days); secret scan of prompts/config finds 0 long-lived static API keys
Workload identity for self-hosted model runtimes
- Artifact
- Workload-identity binding config for self-hosted model runtimes + sample authenticated call traces
- Pass condition
- Every self-hosted model runtime in production authenticates via workload identity (SPIFFE/IAM role/equivalent); 0 static shared keys in the runtime inventory
Evidence required
- Auth architecture for AI and MCP surfaces
- Evidence that anonymous access is disabled in production
- Admin access controls documentation
Severity & risk
- Severity
- critical
- Impact if violated
- Risk level
- critical
- Typical residual risk (impact × likelihood)
Engineering best practices
- Prefer OAuth2/OIDC or workload identity over static API keys
- Issue distinct identities per agent class
- Rotate credentials automatically; detect leaked keys in repos and prompts
- Authenticate both directions for A2A where feasible
Automatic validations
- Integration tests rejecting unauthenticated calls
- Secret scanning for exposed AI API keys
- Config checks that MCP auth is enabled
Manual validations
- Identity design review for new agent entry points
- Periodic access review of AI admin roles
Examples
- An MCP server requires OAuth for every client; local-dev uses a distinct non-prod issuer
- A voice AI channel authenticates the telephony session before invoking tools
References
Crosswalks
Secure & Resilient Secure and Resilient
NIST AI Risk Management Framework · aligns-with
CC6 Logical and Physical Access
SOC 2 Trust Services Criteria · evidence-for
Security Security
AWS Well-Architected Framework · aligns-with
Future evolution
Standard agent identity profiles and passport-like credentials for cross-org A2A.