🔶 AI Agent 认证与授权（IETF Internet-Draft）

Agent 凭证配置是指在运行时签发、续期、管理生命周期状态以及轮换 Agent 用于向其他 Agent 进行身份认证和授权的凭证。Agent 可按第 7 节所述配置一种或多种凭证类型。与静态密钥不同，Agent 凭证以动态方式配置，并且有意设定为短生命周期，从而消除手动管理过期时间带来的运维负担，并降低凭证泄露造成的影响。¶

凭证配置也是用于确认 Agent 及其运行时环境是否满足姿态要求的评估点。在本文档中，姿态评估是指对有关 Agent、其软件、部署上下文、运行时环境和运行状态的信号进行评估。这些信号会影响是否签发凭证、与凭证绑定何种标识符、签发何种类型的凭证、凭证中包含哪些属性，以及凭证的有效期。¶

姿态评估机制取决于具体部署和风险状况。它们可包括硬件支持的证据、可信执行环境（TEE）证据、软件完整性度量、供应链来源信息、平台或编排层元数据、工作负载放置信息、配置状态、运营方声明，或其他特定环境的信号。根据所涉及的风险，单一信号可能已足够；而高风险部署则可能需要在签发或续期凭证前取得多个相互独立的信号。¶

已部署的工作负载身份系统通常会将某种形式的姿态评估作为凭证配置的一部分。例如，SPIFFE 实现可以在将工作负载绑定至 SPIFFE 标识符并签发 SVID 之前，评估有关该工作负载的平台和环境特定信息。从高层次看，配置组件会收集工作负载和执行上下文信号，根据本地策略进行验证；如果验证成功，则签发短生命周期凭证，用于后续的身份认证和授权。¶

Agent 身份管理系统可结合多种姿态评估机制和实现。机制的选择取决于部署约束，例如底层平台、可用的身份信号，以及所需的信任保障级别。本文档不要求采用任何特定的姿态评估机制、证据格式或验证器架构。¶

Agent 凭证配置必须能够自主运行、支持高频变动环境的扩展，并在每次签发或轮换事件中与用于建立 Agent 信任的姿态评估机制紧密集成。¶

Agent 凭证配置通常包括两个阶段：¶

1. 初始配置：Agent 首次获取与其身份绑定的凭证的过程。这通常发生在部署或实例化之后，并基于 Agent 已验证的属性，例如部署上下文、姿态评估结果或编排元数据。¶

2. 轮换/续期：在短生命周期凭证过期前对其进行自动刷新。持续轮换可确保凭证仅在必要的最短时间内有效，并使授权状态反映当前的运行条件。¶

使用短生命周期凭证可显著改善风险状况并降低凭证暴露风险。它为显式吊销机制提供了替代方案，简化了大型自动化环境中的生命周期管理，同时消除了因凭证到期而导致停机的风险。¶

诸如 [SPIFFE] 的已部署框架，为运行时自动化配置短生命周期凭证提供了经过验证的机制。除签发短生命周期凭证外，[SPIFFE] 还会配置与每个凭证绑定的临时加密密钥材料，从而进一步降低长期密钥遭泄露相关的风险。¶

大语言模型不得访问 Agent 的凭证，也不得访问可能用于访问工具和服务的凭证。这可防止大语言模型使用、暴露这些凭证，或因提示注入攻击被操纵而泄露凭证。¶

Agent credential provisioning refers to the runtime issuance, renewal, lifecycle state and rotation of the credentials an agent uses to authenticate and authorize itself to other agents. Agents may be provisioned with one or more credential types as described in Section 7. Unlike static secrets, agent credentials are provisioned dynamically and are intentionally short-lived, eliminating the operational burden of manual expiration management and reducing the impact of credential compromise.¶

Credential provisioning is also the assessment point to confirm that the Agent and its runtime environment satisfy the posture requirements. In this document, posture assessment refers to the evaluation of signals about the Agent, its software, deployment context, runtime environment, and operational state. These signals can influence whether a credential is issued, which identifier is bound to the credential, what type of credential is issued, what attributes are included in the credential, and how long the credential remains valid.¶

Posture assessment mechanisms are deployment and risk specific. They may include hardware-backed evidence, trusted execution environment (TEE) evidence, software integrity measurements, supply-chain provenance, platform or orchestration-layer metadata, workload placement information, configuration state, operator assertions, or other environment-specific signals. Depending on the risk involved, a single signal may be sufficient, while higher-risk deployments may require multiple independent signals before credentials are issued or renewed.¶

Deployed workload identity systems commonly perform some form of posture assessment as part of credential provisioning. For example, SPIFFE implementations can evaluate platform and environment-specific information about a workload before binding it to a SPIFFE identifier and issuing an SVID. At a high level, a provisioning component gathers workload and execution context signals, verifies them according to local policy, and, if verification succeeds, issues short-lived credentials for subsequent authentication and authorization.¶

An Agent Identity Management System may incorporate multiple posture assessment mechanisms and implementations. The selection of mechanisms depends on deployment constraints, such as the underlying platform, available identity signals, and desired level of trust assurance. This document does not require any particular posture assessment mechanism, evidence format, or verifier architecture.¶

Agent credential provisioning must operate autonomously, scale to high-churn environments, and integrate closely with the posture assessment mechanisms used to establish trust in the Agent at each issuance or rotation event.¶

Agent credential provisioning typically includes two phases:¶

1. Initial Provisioning : The process by which an agent first acquires a credential bound to its identity. This often occurs immediately after deployment or instantiation and is based on verified properties of the agent (e.g., deployment context, posture assessment results, or orchestration metadata).¶

2. Rotation/Renewal : The automatic refresh of short-lived credentials before expiration. Continuous rotation ensures that credentials remain valid only for the minimum necessary time and that authorization state reflects current operational conditions.¶

The use of short-lived credentials provides a significant improvement in the risk profile and risk of credential exposure. It provides an alternative to explicit revocation mechanisms and simplifies lifecycle management in large, automated environments while removing the risks of downtime as a result of credential expiry.¶

Deployed frameworks such as [SPIFFE] provide proven mechanisms for automated, short-lived credential provisioning at runtime. In addition to issuing short-lived credentials, [SPIFFE] also provisions ephemeral cryptographic key material bound to each credential, further reducing the risks associated with compromising long-lived keys.¶

The Large Language Model MUST NOT have access to an agent's credentials or to credentials that may be needed to access tools and services. This prevents the Large Language Model from using, exposing, or being manipulated via prompt injection into disclosing the credentials.¶