Trusted AI Agent Transactions, Part 4: PingAuthorize Policy Decisions

The SPIRE workload identity system employs two distinct credential formats: JWT-SVID and X.509-SVID. The former authenticates the logical agent to PingFederate during token exchange via RFC 8693, while the latter secures workload-to-workload connections with mTLS. The JWT-SVID operates under a dedicated audience for PingFederate Transaction Token Service integration, guaranteeing a distinct trust domain for the request chain.

This design prevents the mixing of two separate trust boundaries. As the transaction token persists throughout the request path, the immediate caller identity shifts at each hop: from the agent to the gateway, then to the MCP server, and finally to the protected API. This mechanism allows the protected API to reject direct agent connections, even if they possess a valid transaction token.

The API can enforce the required transaction context and MCP server identity via the existing mTLS connection. In local development, Docker workload attestation is utilized, creating separate SPIFFE IDs for each workload using distinct labels and registrations. However, in a production setting, a production-apt attestation method should be employed, such as cloud instance identity, Kubernetes PSAT, X.509 proof of possession, or hardware-backed attestation.

SPIRE signing keys may overlap during rotation, but the integration accepts multiple JWT authorities provided each has a unique, non-empty key ID and complies with key and algorithm constraints. The token header cannot dynamically adapt to new trusted algorithms, maintaining a consistent binding rule: a workload cannot transform into another logical agent by altering request data.