Modern cloud-native environments are dynamic, distributed and increasingly ephemeral, yet many services still authenticate using shared API keys and long lived credentials. These secrets are difficult to rotate, attribute and contain when compromised.
This session explores how SPIFFE provides verifiable identities for workloads and how short lived SVIDs, combined with mutual TLS enable workloads to authenticate each other and establish encrypted service to service communication without relying on shared credentials. It will cover the trust flow from workload attestation and identity issuance to certificate rotation, trust domains and policy enforcement.
We will also extend this model to AI-agent workloads, establishing which agent is connecting is essential, but identity alone does not define what the agent is authorized to accomplish. Mission bound authorization can complement workload identity by connecting an agent's identity with its purpose, delegated authority, permitted actions, runtime constraints and audit context.
