Agentic AI Security
Glossary
Plain-language definitions for the vocabulary of AI security: agent and workload identity, MCP security, AI threats, and governance.
Non-Human Identity
A non-human identity (NHI) is a unique descriptor assigned to a technological system, such as a machine, application or AI agent, for authentication and authorization.
Glossary categories
Six clusters spanning AI threats, agent & workload identity, MCP security, and governance.
AI Threats
Security
Agent Identity
Workload Identity
MCPs
Governance & Compliance
Featured terms
Explore the glossary
Agent Attestation
Agent attestation is a process that cryptographically proves an AI agent’s identity and integrity — the agent is who it says it is, does what it says it does, and hasn’t been modified. Before an agent can access services, databases, or other sensitive resources, an attestation mechanism (such as a SPIRE agent) reviews its code, model, and execution environment to confirm authorization. Attestation may also include the agent’s platform, software, and hardware.
Agent Authorization
AI agent authorization is the security process that determines what an AI agent may do after authentication. It decides which tools the agent can call, which data it may read or write and which services it has access to. These decisions are enforced by policies operating independently of the agent and apply to every agent action.
Agent Credential Provisioning
Agent credential provisioning is the process of scoping and issuing cryptographic credentials to verified AI agents at runtime. These time-bound, task-specific and traceable credentials let agents authenticate to necessary resources, including APIs and other agents. The SPIFFE runtime environment (SPIRE) automates agent credential provisioning, active revocation and traceability.
Agent Observability
AI agent observability is the capture and analysis of every decision made, and every action taken, by agentic AI. This comprehensive practice offers complete visibility into agent reasoning, tool calls, data retrieval and model outputs. Agent observability matters because it reveals whether agents have made logical, safe choices within authorized bounds. If misbehavior occurs, organizations can detect it, take corrective action and determine the reasoning to prevent recurrence.
Agent to Agent Protocol (A2A)
The Agent2Agent (A2A) Protocol is an open standard that allows AI agents to authenticate and communicate securely across platforms and frameworks. A2A doesn’t require agents to reveal their internal logic, which makes it ideal for secure collaboration in multi-agent systems. In 2025, Google developed the standard and donated it to the Linux Foundation.
AI Agent Identity
Agent identity, or AI agent identity, is a digital identity assigned to an AI agent. The identity is unique, verifiable, and distinct from human users or static service accounts.
Identity and Access Management (IAM)
Identity and access management (IAM) comprises the protocols and tools that determine whether specific users, devices, and services can use certain systems — and how.
MCP Authentication
Model Context Protocol (MCP) authentication is the process that verifies the identity of clients requesting access to a server’s tools, resources or data. It requires new validation with every request.
MCP Server Security
MCP security refers to the controls that govern Model Context Protocol (MCP) servers. MCP servers connect AI agents to external tools, APIs and data sources. Securing MCP servers helps defend against unauthorized access, rug pull attacks, tool poisoning, prompt injection, credential misuse or theft and supply chain attacks. However, the MCP specification includes no built-in security enforcement. Organizations must implement authentication, authorization and other security controls themselves.
mTLS for AI Agents
Mutual Transport Layer Security (mTLS) for AI agents is a security protocol where both the agent and the connecting service verify each other with X.509 digital certificates.
Non-Human Identity
A non-human identity (NHI) is a unique descriptor assigned to a technological system, such as a machine, application or AI agent, for authentication and authorization.
OWASP NHI Top 10 – Environment Isolation
OWASP NHI8:2025 - Environment Isolation, also called NHI8:2025, is the 8th risk listed in the OWASP Non-Human Identities Top 10 framework. It outlines the failure to assign separate non-human identities in deployment environments, which can allow shared credentials used in less-protected development or staging systems to be used directly in production.
Phishing-Resistant MFA
Phishing-resistant multi-factor authentication (MFA) is an advanced verification method that combines public key cryptography (protects credentials) and origin binding (links logins to specific domains).
Prompt Injection Attacks
Prompt injection attacks manipulate large language model (LLM) inputs with malicious instructions to override intended behaviors or trigger unauthorized actions. It’s like command injection or SQL injection, but for AI.
Secret (Credential)
A secret, or credential, is a digital authentication material such as an API key, token, SSH key, database password or certificate that a machine, service or AI agent uses to prove its identity to another system. Secrets are the equivalent of passwords for non-human entities. They control access to infrastructure, data, and downstream services, and can be high-value targets for attackers.
Shadow AI
Shadow AI is the unsanctioned use of artificial intelligence models, tools or embedded AI-powered features by employees. It occurs without the knowledge, approval or oversight of an organization’s IT or security team, which leads to data exposure and compliance violations. Few organizations are capable of reliably detecting or mitigating shadow AI in practice.
Short-Lived TLS Certificates
Short-lived Transport Layer Security (TLS) certificates are credentials with validity periods that range from a few hours up to 90 days. With limited lifespans and automatic renewal, short-lived credentials reduce potential attack exposure and overreliance on external revocation mechanisms. They’re a valuable security solution for agentic AI and other non-human identities.
SPIFFE
Secure Production Identity Framework for Everyone (SPIFFE) is an open-source standard for establishing cryptographic identities for software workloads, microservices and containers.
SPIRE Server
A SPIRE Server is the control plane for SPIFFE environments. It acts as the central certificate authority and trust anchor for assigning cryptographic identities (known as SPIFFE Verifiable Identity Documents or SVIDs) to workloads, AI agents and containers.
SVIDs
A SPIFFE Verifiable Identity Document (SVID) is a credential that establishes identity for a workload, service or container to a resource or another service. The credential is cryptographically signed and encodes a unique SPIFFE ID issued in either X.509 or JWT format.
Workload Identity
Workload identity is a unique, cryptographically verifiable identity assigned to a non-human software workload such as a microservice, application, container, serverless function or scripts.
X.509 Certificate
An X.509 certificate is a standardized digital file which cryptographically binds a public key to an identity such as a person, device, server, workload or AI agent.
X.509 SVIDs
An X.509 SVID is an X.509 certificate that gives service or AI agents a cryptographically verifiable credential. The SVID is short-lived, typically just 5-15 minutes, and encodes a SPIFFE ID in its Subject Alternative Name (SAN) extension. The credential can be used to authenticate over mutual TLS without relying on static secrets.
Zero-Trust for AI
Zero Trust for AI expands the “never trust, always verify” cybersecurity principle to the complete AI lifecycle. Just as no network user deserves implicit trust, no model, agent or pipeline deserves or receives it, either. Instead, zero trust demands that live policies serve as the basis for continuous validation of every AI component, from model training and data ingestion to deployment and agent behavior.