Agent identity & access
Teleport issues short-lived certificates, JWTs and SPIFFE-compatible identities to bots, CI jobs, workloads and AI agents via its tbot agent, then enforces role-based access and records every command an agent runs against SSH hosts, Kubernetes clusters, databases and MCP servers. Agent use cases are positioned around design partnerships.
hybrid · generally available · Research snapshot 2026-09-06
Visit the official product source ↗Agent identity & access · Runtime authorization & controls · Observability & traceability
Useful conversation with: Platform engineer, Infrastructure security lead, DevSecOps lead.
Show an AI agent issued its own Teleport identity, restricted to read-only Kubernetes access by RBAC, with the full session recording of its commands.
Support labels reflect the supplied research. Documentation and vendor claims are not independent product tests. “Not established” means the researcher did not find support; it does not prove a capability is absent.
Documented by provider
Teleport issues each AI agent its own identity and enforces access and privileges for agents accessing SSH servers, Kubernetes clusters, databases and MCP servers.
Limit: The docs page does not state GA status for the AI agent use case and invites design partnerships.
Vendor claim
The platform issues and renews short-lived X.509 certificates, JWTs and SPIFFE-compatible workload identities for bots, CI jobs, containers, VMs, services and AI agents.
Limit: Platform page is marketing; per-protocol rotation intervals are not stated.
Documented by provider
All queries, commands and requests executed by an agent are logged, providing visibility and auditability.
Limit: Retention, export and tamper-evidence properties are not described on the fetched page.
Listing does not imply partnership, supplier status, a working DutyGraph integration, or a compliance certification.
Suggest a correction