Full Report
SPONSORED FEATURE: DigiCert wants to hand every agent a passport, complete with an expiry date and a named human owner
Analysis Summary
# Best Practices: Governance for AI Agents and Models
## Overview
These practices address the security risks associated with "shadow AI" and the proliferation of autonomous AI agents. They provide a framework for establishing identity, verifying model integrity, and enforcing policy for non-deterministic agents that often operate outside traditional Human Identity and Access Management (IAM) systems.
## Key Recommendations
### Immediate Actions
1. **Stop using static API keys:** Cease the practice of assigning long-lived, high-scope API keys to AI agents as a substitute for identity.
2. **Conduct an "Agent Inventory":** Identify which AI agents (e.g., Claude Desktop, OpenAI Codex) are being used by employees and what sub-agents they are spawning.
3. **Implement DNS-based Policy Records:** Create a DNS-based declaration (similar to DMARC) to list authorized agent identities and their permitted scopes.
### Short-term Improvements (1-3 months)
1. **Shift to Workload Identity:** Transition AI agent management from human IAM stacks to workload identity frameworks like SPIFFE/SPIRE.
2. **Enforce Short-lived Credentials:** Move toward runtime attestation where agents are issued temporary credentials that expire frequently.
3. **Deploy MCP Gateways:** Use Model Context Protocol (MCP) gateways to monitor agent sessions and terminate connections if an agent attempts to contact unauthorized domains.
### Long-term Strategy (3+ months)
1. **Adopt Confidential Computing:** Run AI models within Trusted Execution Environments (TEEs) using hardware like Intel TDX or AMD SEV-SNP to ensure memory encryption and isolation.
2. **External Attestation:** Utilize a third-party attestation service (following IETF RATS architecture) to verify environment integrity rather than relying on cloud provider self-attestation.
3. **Cryptographic Model Integrity:** Establish a "tamper-evident trail" for every inference to prove the model running in production is the exact version that was authorized/audited.
---
## Implementation Guidance
### For Small Organizations
- Focus on visibility: Use DNS logs to identify unauthorized AI API calls.
- Avoid building custom agents; stick to reputable vendors with clear enterprise governance controls.
### For Medium Organizations
- Implement a centralized gateway for all AI traffic to monitor data flow.
- Map agent "owners" (named humans) to every deployed service account to ensure accountability.
### For Large Enterprises
- Deploy **SPIFFE/SPIRE** across Kubernetes estates to manage agent identities at scale.
- Integrate **Confidential Computing** for regulated workloads (Healthcare, Finance) to meet FDA or financial data integrity standards.
---
## Configuration Examples
**DNS Agent Policy Record (Conceptual):**
text
_ai-agent-policy.example.com IN TXT "v=AIP1; auth=cert.digicert.com; identity=agent-001; scope=read-only; target=api.vector-db.internal"
*Logic: A gateway checks this record; if "agent-001" attempts a "write" operation or contacts an external domain not listed, the session is terminated.*
---
## Compliance Alignment
- **NIST Cybersecurity Framework (CSF) 2.0:** Aligns with governance and asset management tiers for AI workloads.
- **IETF WIMSE:** Follows Workload Identity Management and Security Extensions.
- **IETF RATS:** Remote ATtestation Procedures for hardware-level security.
- **FDA 2023 Cybersecurity Guidance:** Meets requirements for software integrity and SBOM enforcement in medical AI.
---
## Common Pitfalls to Avoid
- **Treating Agents as Humans:** Do not force agents into human MFA workflows; they cannot "tap to approve," leading to the dangerous fallback of static, over-privileged keys.
- **The "Parent-Child" Privilege Gap:** Assuming sub-agents spawned by a primary agent inherit the same restrictions. Often, sub-agents bypass controls if not explicitly governed.
- **Cloud Provider Self-Attestation:** Relying on the same company hosting your data to verify that the environment hasn't been compromised.
---
## Resources
- **SPIFFE/SPIRE:** [https://spiffe[.]io/]
- **DigiCert AI Trust Whitepaper:** [defanged-link: digicert[.]com/solutions/ai-trust]
- **IBM Cost of a Data Breach Report:** [defanged-link: ibm[.]com/security/data-breach]
- **NIST AI Risk Management Framework:** [https://www.nist[.]gov/itl/ai-risk-management-framework]