AWS shows how to give each AI agent a verifiable digital ID

AWS has published a reference design for proving which AI agent made a request, and on whose behalf. It was built with security company Keyfactor. Each agent gets its own digital ID, a certificate that others can check. The goal is to stop one agent from posing as another when it reaches into things like a company database.

The problem it targets

Many AI agents now connect to outside tools through a standard called the Model Context Protocol, or MCP. It describes how an agent asks a tool to do something, such as run a database query or handle email. But MCP has no built-in way to check who is asking. Without extra safeguards, any component could pretend to be an agent, replay stolen credentials, or use a tool without permission.

AWS says common shortcuts fall short. Those include sharing API keys between parts of a system or passing login tokens down a chain of agents.

Four checks, working together

• Signed requests: every agent call carries proof that the agent holds its own secret key.
• User-signed permission: the user authorizes an agent without handing over their own credentials.
• Narrow tokens: a token is limited to one service, so a leak cannot open other doors.
• Instant revocation: a live status check (called OCSP) spreads a canceled credential to all agents right away.

How login works

In the example, the user signs in first. The app then swaps the user's full-access token for a limited one that works only with the MCP tool server. Only that limited token goes to the agents. AWS says that if it leaks, it cannot reach any other service in the organization. Agents never hold the user's private key or full-session token.

What is behind it

The design uses Keyfactor's EJBCA Enterprise, a product that issues and manages digital certificates. AWS services handle the AI side, including Amazon Bedrock. Keyfactor says more than 1,500 enterprise customers use its machine identity platform, across finance, healthcare, manufacturing and government. The example protects a database, but AWS says the same pattern fits any MCP-compatible tool server. Source code is available in a GitHub repository.

What is not clear

The material does not give costs or performance figures. It also does not say how much work it takes for a small business to set this up. This is a reference design for technical teams to adapt, not a ready-made product for everyday users.