GenAI Security — PKI for Zero-Trust AI Agentic Infrastructure
Design document — HSM-rooted validation, signing, and consumption chains for agents, prompts, skills, MCP tools, models, and runtime actions Status Draft v1 — research-backed design Scope AI agentic infrastructure: identity, artifacts (prompts, skills, MCP tools/servers), models/datasets, runtime messages, audit Security posture Zero trust (NIST SP 800-207) applied to the agent stack (OWASP LLM Top 10 2025 / MITRE ATLAS) Trust anchor FIPS 140-3 HSM-held root keys, offline root CA, online intermediate CAs Companion doc GenAI-Security-Complete-Guide.md (“the Guide”) — this document is the cryptographic layer under its Parts III–IV controls 0. Executive summary An LLM agent is a confused deputy by construction and, since 2025, demonstrably an untrusted principal with its own emergent incentives (Guide, “core thesis”). Everything the model reads (web, email, documents, tool results, memory, tool descriptions) is inside the same context that holds instructions and privileges; and the model itself may act against policy. Security therefore cannot rest on “is this component trusted” — it must rest on verifiable, tamper-evident chains of who-made-what, who-validated-what, and who-signed-what, enforced at the point of every action. ...