Cryptography, and the ability to govern cryptographic processes at scale, enabled the first digital transformation. It will enable the next one too.
By Trell Rohovit, Garantir CEO
I have spent three decades in cybersecurity and digital identity, and every wave of digital transformation I have lived through had the same behind the scenes enabler. It was never the new applications, cool feature or the shiny next device we carried. It was the invisible layer that made it safe to participate at all: “trust”. That trust was built through cryptography and through the ability to govern cryptographic processes at scale.
Consider how we got here. The public SSL/TLS trust model, and the lock icon in the browser, completely changed the dynamic of how society uses the internet. Before it, the web was a place to read. After it, the web became a place to transact, to bank, to shop, to file taxes, to run businesses. Nobody outside the security community thought about certificate authorities or key exchanges. They saw the lock and proceeded with confidence. Federated identity and single sign-on did the same for our daily digital lives. Behind every seamless “sign in with” experience sits a set of cryptographic keys, signed assertions, and token exchanges that let us move securely across dozens of services without ever thinking about it. Code signing, paired with private trust stores, made over the air software distribution possible at global scale, from routine operating system updates to the firmware that now runs our cars.
Trust was enabled by applying well understood cryptographic primitives, the old school trust enablers of authentication, message integrity, privacy, and non-repudiation, through governance models and operations that could deploy at the scale of the use case. The algorithms themselves continue to evolve, and the migration to post quantum cryptography is already underway, but the trust enablers they deliver remain constant. That is the pattern…and it is about to repeat at a scale and consequence that will make the last digital transformation look like a warm up.
The Agentic Era Needs the Same Trust Enablers, Governed at a New Scale
We are now at the front edge of the next transformation, autonomous AI agents that don’t just generate content but take action. They read data, call tools, rotate credentials, deploy code, move money. The productivity opportunity is enormous. So is the trust problem (again). Industry assessment tell a consistent story: essentially every organization has agentic AI on its roadmap, yet only a small number enforce any binding between an agent and its authorized purpose, and fewer than one in five security leaders believe today’s identity and access management (IAM) stack can handle agent identities at all.[1]
The answer to this problem is not a mystery, because we have solved this exact class of problem before. The agentic era requires the same trust enablers, delivered through more sophisticated cryptographic services management.
It starts with the authenticity of the agent and its intent – a known, attested workload that can prove who it is cryptographically, anchored in keys and certificates rather than the naming conventions researchers at MIT, Harvard, and Stanford have already shown are spoofable.[2] It extends to the resources and data the agent can reach, with access scoped, delegated from an authorized principal, and cryptographically bound. It ends with the actions the agent performs, where high consequence operations require verifiable authorization at the moment of execution.
Authentication, message integrity, privacy and non-repudiation. The same four trust enablers that secured the first digital transformation, now applied to a new class of actor.
Bootstrap Every Agent Back to a Human, and Inherit the Frameworks You Already Trust
Here is what much of the agentic security conversation misses: enterprises do not need an adjacent, parallel governance universe for agents. They need a way to plug agents into the governance universe they already have. Critically, NIST’s stated direction backs this concept, adapt existing identity standards for agents rather than invent new ones.[3]
Existing enterprise security and compliance models rest on a handful of durable tenets, controls aligned with risk, governance and oversight, visibility and auditability, and independent third party evaluation. Those tenets don’t expire because the actor is an agent instead of an employee. They apply directly, provided every agent based process can be bootstrapped back to an authorized human or entity.
Making the “human” the antecedent of every system authentication, data access and action cryptographically real. When an agent’s authority is delegated from a verified human identity, when its scoped access is bound to that delegation, when high-risk actions are gated by step up approval and “human in the loop” at the point of key access, and when every operation produces a signed, tamper evident audit record, the agent is no longer an ungoverned black box. It is a governable extension of an accountable principal, and it slots into the frameworks the enterprise already operates: least privilege, separation of duties, the audit and non repudiation requirements of regimes like NIST 800-53, and the attestations your auditors already understand.[4]
Done right, we are not building a compliance framework for agents from scratch. The key elements of the security and compliance framework needed to embrace agentic workloads are already in place. Cryptographic delegation is what activates them.
The Real Threat Model, and Where Cryptographic Services Answer It
The failures we’re seeing in early agentic deployments aren’t hypothetical, and they map to cryptographic processes or control.
Prompt injection is a leading threat, an agent instructed mid task to “also export every customer record” will try to inherit its full decryption scope. The cryptographic answer is identity bound decryption. Out of scope data remains ciphertext, because scope cannot be escalated by language, only by keys. This is also why transparent database encryption (TDE) is no longer enough. An agent with database access reads straight through storage level encryption, so the agentic world requires encryption at the datum level, bound to identity. Token and credential replay, where a stolen bearer token is reused at will, fails when requests must be signed. A compromised agent runtime becomes an exfiltration path when keys live in the agent’s memory; when no key material resides in the agent at all, there is nothing to steal. Unbounded action authority, where an agent rotates secrets or redeploys production with no human approval, is answered by per action signing with step up ”human in the loop”, just in time access, or quorum approval on high value operations. And a tamper evident audit trail becomes proof rather than mere logging when every operation produces a signed record the SIEM can independently verify.
Step back from the individual threats and the pattern is unmistakable. In the agentic era, a valid credential plus authorized access no longer equals a safe outcome. The outcome itself must be cryptographically enforced.
The industry’s main challenges tell the same story. Dynamic agent registration, because static registries can’t keep pace with agents that spin up and down by the session, calls for ephemeral attestation and short lived certificates issued per session. Trusted agent software calls for code signed containers and signed model artifacts with verified provenance before anything runs. Delegated authorization and “on behalf of” flows, including the genuinely hard problem of multi hop delegation where agents create agents, call for delegation cryptographically bound to the originating user. Attestable agent output calls for signed, verifiable records of every operation. None of these are exotic requirements. They are the classic disciplines of certificate lifecycle management, code signing, key based authentication, and encryption, extended to a new class of identity.
Private Trust and Public Trust, Both Models Are Coming, and Both Run on Cryptography
The internet’s trust architecture has always been multi-tiered, and the agentic world will inherit a similar structure.
Inside the enterprise, organizations build private trust hierarchies. For private PKI and root of trust for their own controlled ecosystem, where they set the rules according to their own security and compliance framework. Agentic workflows serving internal purposes will live here. The enterprise defines which agents are enrolled, what attestation is required, which actions demand human approval, and what its own cryptographic processes must guarantee. The enterprise is the policy authority, exactly as it is for its internal private PKI today.
But no enterprise is an island. There will be, and already are, use cases where an organization must rely on or accept an agent-based workflow outside its control, a partner’s procurement agent, a customer’s support agent, a counterparty’s settlement agent. For those cross domain interactions, enterprises will look for cryptographic assurance rooted in a public trust model, analogous to today’s public TLS ecosystem, where trust across domains is enabled by standards bodies and industry policy consortiums rather than any single party’s say so. Early signals of this public layer are already visible in Google’s Agent2Agent protocol and registry[5], the Agent Name Service proposal[6], emerging specifications like AAuth[7] and Web Bot Auth, and more.[8]
The essential point is that both models, private and public, are enabled by the same underlying instrument, cryptographic processes and services, with the rules of trust set according to the model. Enterprises that build their agentic security on cryptographic foundations position themselves for both worlds at once.
The Roadmap Has Emerged, Regulators and Standards Bodies Agree
The strongest validation of the cryptographic services approach is that the world’s leading security authorities have independently converged on it. Across their 2026 guidance, the same short list of cryptographic services keeps appearing: a distinct cryptographically anchored identity for every agent instead of shared credentials; signed, verifiable authorization of agent actions; delegation that traces back to an accountable human; encrypted and integrity checked agent communication; and cryptographically secured, non repudiable audit records.
For security architects, this convergence is a gift. It means an enterprise adopting a cryptographic services approach to agentic security is not betting on a proprietary philosophy. It is aligning with the documented direction of NIST, through the NCCoE’s agent identity and authorization concept paper[3] and CAISI’s AI Agent Standards Initiative,[9] CISA, the NSA and their Five Eyes partners,[10] OWASP’s Agentic Security Initiative,[11] the Cloud Security Alliance,[12] MITRE,[13] and the IETF, along with regulatory efforts including the EU AI Act,[14] DORA,[15] and Australia’s Digital Transformation Agency guidance,[16] all converging on a standards backbone of OAuth 2.0/2.1, OpenID Connect, SPIFFE/SPIRE, SCIM, and MCP, and on adapting existing identity and cryptographic standards rather than reinventing them.
Same Old Trust, New Scale
So let’s return to where we began.
The elements that enabled society’s first digital transformation, the elements that actually introduced trust into the equation and made adoption at scale possible, were cryptographic: the TLS lock that made the web transactable, the federated keys behind every sign on, data encryption providing privacy, the code signatures behind every update. Those same elements will carry us through the transition into the agentic era.
We are not recreating cryptography. Authentication, message integrity, privacy, and non repudiation are among the best understood concepts in digital security architecture, hardened by three decades of production use at global scale. What is new, and what will separate the enterprises that embrace agentic transformation confidently from those paralyzed by it, is the maturity of their cryptographic operations and governance layer, cryptographic services capable of enrolling ephemeral agent identities dynamically, delegating scoped authority from accountable humans, signing and verifying actions at machine speed, binding decryption to identity, and producing attestable proof of everything, at the scale and with the complete governance control this emerging use case demands.
To be clear, cryptography is not the end all of agentic security. Other mechanisms matter, from discovery, runtime guardrails to monitoring and sound identity governance. But cryptographic processes will be the enablers of trust, exactly as they were the last time. The first digital transformation taught us that trust is not declared, it is cryptographically built, governed, and verified. The agentic transformation will be no different.
Citations
[1] Cloud Security Alliance and Strata Identity, “Securing Autonomous AI Agents: Survey Report,” 2026.
[2] T. South, S. Marro, T. Hardjono, R. Mahari, C. D. Whitney, D. Greenwood, A. Chan, and A. Pentland, “Authenticated Delegation and Authorized AI Agents,” MIT Media Lab, January 2025. arXiv:2501.09674.
[3] NIST National Cybersecurity Center of Excellence (NCCoE), “Accelerating the Adoption of Software and AI Agent Identity and Authorization,” Concept Paper, February 2026.
[4] NIST, “Security and Privacy Controls for Information Systems and Organizations,” Special Publication 800-53 Rev. 5 (including AU-10, Non-Repudiation), 2020.
[5] Google, “Announcing the Agent2Agent Protocol (A2A): A New Era of Agent Interoperability,” Google Developers Blog, April 2025.
[1] K. Huang et al., “Agent Name Service (ANS): A Universal Directory for Secure AI Agent Discovery and Interoperability,” May 2025. arXiv:2505.10609.
[7] J. Rosenberg and P. White, “AAuth – Agentic Authorization OAuth 2.1 Extension,” IETF Internet-Draft, draft-rosenberg-oauth-aauth.
[8] IETF Web Bot Auth (WBA) Working Group; see also Google, “Authenticating Requests with Web Bot Auth,” Google Crawling Infrastructure documentation, 2026.
[9] NIST Center for AI Standards and Innovation (CAISI), “AI Agent Standards Initiative,” launched February 2026.
[10] CISA, NSA, ASD ACSC, CCCS, NCSC-NZ, and NCSC-UK, “Careful Adoption of Agentic AI Services,” joint Five Eyes guidance, April 30, 2026.
[11] OWASP GenAI Security Project, “Agentic Security Initiative: Agentic AI – Threats and Mitigations” and the Agentic Top 10 (ASI01–ASI10).
[12] Cloud Security Alliance, “Agent Identity Governance Framework,” CSA Labs, 2026.
[13] MITRE, “ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems.”
[14] European Union, “Regulation (EU) 2024/1689 (Artificial Intelligence Act),” Official Journal of the European Union, 2024.
[15] European Union, “Regulation (EU) 2022/2554 on Digital Operational Resilience for the Financial Sector (DORA),” Official Journal of the European Union, 2022.
[16] Australian Government Digital Transformation Agency, “AI Technical Standard: Agentic AI Addendum,” June 2026.