Agent identity & access
A CNCF graduated open-source toolchain that attests running workloads and issues them short-lived SPIFFE identities (X.509 and JWT SVIDs) through the Workload API, enabling mutual TLS and authentication to secret stores, databases and cloud services. It provides identity plumbing, not agent inventory or governance workflows.
open_source · generally available · Research snapshot 2026-09-06
Visit the official product source ↗Agent identity & access · Runtime authorization & controls
Useful conversation with: Platform engineer, Security architect, SRE.
Demonstrate a Kubernetes workload attesting to SPIRE, receiving a rotating X.509 SVID, and using it for mTLS to another service across a federated trust domain.
Support labels reflect the supplied research. Documentation and vendor claims are not independent product tests. “Not established” means the researcher did not find support; it does not prove a capability is absent.
Documented by provider
SPIRE exposes the SPIFFE Workload API to attest running software systems and issue them SPIFFE IDs and SVIDs, enabling mTLS or signed JWT authentication between workloads.
Limit: Repository README does not address AI-agent-specific governance, inventory or approval workflows.
Documented by provider
SPIRE is maintained by the SPIFFE community and is a graduated project of the Cloud Native Computing Foundation.
Limit: Graduation status does not imply enterprise support or SLAs.
Documented by provider
SPIFFE specifications define short-lived cryptographic identity documents (SVIDs) issued via a simple API across heterogeneous environments and organizational boundaries.
Limit: Specification-level description; implementation coverage varies by SPIFFE implementation.
Listing does not imply partnership, supplier status, a working DutyGraph integration, or a compliance certification.
Suggest a correction