# Agent Identity on Kubernetes: The Complete Series

> How an AI agent proves who it is: workload identity federation, SPIFFE SVIDs, OAuth token exchange, RFC 8707 audience binding, and what the MCP spec does and does not cover yet.

- Canonical URL: https://webofmike.com/agent-identity/
- Author: Mike Moore (https://webofmike.com/about/)
- Published: 2026-09-16
- Last modified: 2026-09-16
- Tags: AI Agents, Security, Platform Engineering, MCP, Kubernetes
- Cite as: Mike Moore, "Agent Identity on Kubernetes: The Complete Series", Web of Mike (webofmike.com), 2026-09-16. https://webofmike.com/agent-identity/


An AI agent that calls a model, a tool, or another agent has to prove who it is. Almost every production failure I have written up this month traces back to that one question being answered badly, or being answered for the wrong party.

This series works the problem from the bottom up: what the protocol specs actually define, what the platform can issue underneath them, and where the gap between the two has to be filled by a gateway.

## The short version

**The agent should hold nothing.** Every credential an agent stores is a credential that leaks when the agent is compromised, and agents are compromised through their tool surface, not their login page. The pattern that holds up is: the agent presents an identity the platform already gave it, and something on the call path exchanges that identity for a short-lived, audience-bound token.

**The spec layer is behind the platform layer.** MCP's roadmap names agent identity as a priority workstream, but the only stable piece authenticates the *employee behind* the agent, not the agent. If you are shipping this quarter, the workload identity you need exists — just one layer down, in SPIFFE, in Kubernetes projected tokens, and in gateway-mediated token exchange.

**Audience binding is the control people skip.** A token that names no audience is replayable against every backend sharing an issuer. RFC 8707 fixes that, and the implementations that support it tend to ship with it switched off.

## How to read these

Start with [the MCP agent identity gap](/mcp-agent-identity-gap/) if you want to know what the protocol does and does not promise you. Start with [secretless agents](/secretless-ai-agents/) if you want a working demo first and the spec argument later.

The posts below are listed newest first. They are independent — none assumes you read the others — but they were written against one running argument, and the audience-binding and token-service posts are the most directly operational of the set.