Prompt: Using X.509 PKI for AI Agent Identity on AWS

The supplied AWS AI post describes a reference architecture for proving AI agent identity with X.509 public key infrastructure on AWS. It explains that multi-agent systems using Model Context Protocol can lack built-in authentication. The architecture uses signed request envelopes, user-signed delegation assertions, audience-scoped OAuth tokens, and OCSP revocation checking. AWS and Keyfactor engineering teams present the design.

Copy This Prompt

Act as a security architect. Design a zero trust AI agent authentication plan using X.509 PKI and MCP. Replace placeholders: [AGENT_NAME], [MCP_SERVER], [TRUSTED_CA], [TOKEN_AUDIENCE], [OCSP_RESPONDER], [KEYCLOAK_VERSION]. Include user auth, agent to agent, and MCP auth layers. Add signed envelopes, delegation assertions, RFC 8693 audience scoped tokens, and OCSP checks. Flag prerequisites and verification steps.

Example input

Use the placeholders in the prompt with permitted, anonymized source data.

Expected output

Follow the output format requested in the prompt and verify the result against the source.

Tools

Amazon Bedrock, AWS Secrets Manager, Amazon RDS, Amazon SES, AWS EC2, Keyfactor EJBCA, Keycloak, Model Context Protocol (MCP)