AWS and Keyfactor have described a reference architecture for securing multi-agent AI systems with X.509 public key infrastructure. The design uses Keyfactor EJBCA alongside Amazon Bedrock, AWS Secrets Manager, Amazon RDS and other AWS services.

The architecture addresses identity across three trust boundaries: user-to-system authentication, agent-to-agent communication and agent-to-tool-server access. It uses signed request envelopes to demonstrate possession of an agent’s private key, user-signed delegation assertions to authorize agents without sharing user credentials, RFC 8693 token exchange for audience-scoped tokens, and Online Certificate Status Protocol (OCSP) checks for certificate revocation.

In the described login flow, an application authenticates a user through Keycloak, exchanges the resulting token for a token restricted to the MCP server, and obtains certificates through EJBCA. The user’s private key signs a delegation listing the fingerprints of authorized agent certificates. The source says agents receive the delegation rather than the user’s private key or full-session OAuth token.

For agent-to-agent calls, the sender signs the request payload, tool name, arguments, timestamp and a random nonce using RSA-PSS-SHA256. The receiving agent checks the signature, timestamp freshness, nonce uniqueness, certificate chain, role authorization and OCSP status before processing the request. The example uses Amazon Bedrock through the AWS Strands Agents SDK and a MySQL database accessed through MCP tools. AWS notes that the pattern can also apply to other MCP-compatible tool servers.