Cryptographic agent identity (PKI) for all agents

Control objective

Cryptographic agent identity gives every agent a verifiable, machine-checkable identity using public-key infrastructure (PKI), so that when agents talk to each other or to bank systems, each one can prove it is who it claims to be. Without strong identity, a malicious or spoofed agent could impersonate a trusted one and issue instructions - a serious threat in agent-to-agent (A2A) workflows that move money or release data. To implement, issue each agent an X.509 certificate from a managed certificate authority, require cryptographic authentication on every A2A message (not just at session start), rotate credentials on a tight schedule, and log identity issuance, message authentication and rotation events as evidence; integrate this with the bank's existing PKI and secrets management. No statistical metric applies; verification is cryptographic. The threshold has three parts: 100% of agents hold a valid X.509 identity, per-message authentication is enforced on all A2A traffic, and credentials are rotated within 24 hours. Any agent without a valid certificate, any unauthenticated A2A message, or credentials older than 24 hours is a breach that must block the agent or message and trigger reissuance, since it opens the door to impersonation.