For years, privileged access has largely focused on human administrators. But that picture is changing quickly.
This was one of the key themes in our recent webinar with Info-Tech: privileged access is no longer only about managing privileged users.
It is increasingly about governing privileged actions, regardless of whether they are performed by a person, a workload or an AI agent. So, where does ephemeral certification fit in?
What does ephemeral certification mean?
In this context, ephemeral certification means using short lived certificates to authenticate an identity when access is needed. Instead of storing and repeatedly using a static password, SSH key or long lived certificate, a new certificate is issued for a specific access request and expires automatically after a limited period.
The idea is simple: access should exist only for as long as it is required.
But the certificate’s lifetime is only part of the picture. Ephemeral access can also be connected to context. Who or what is requesting access? Which resource do they need? What action are they allowed to perform? Does the request meet the organization’s policies?
Why does it matter for AI agents?
This becomes particularly important for AI agents. Unlike a traditional script, an agent may make decisions dynamically, use several tools or create subagents to complete a task. Giving it broad, standing privileges can therefore create access paths that are difficult to predict or control.
Short lived certificates help reduce this exposure by giving each identity access for a defined purpose and period. Once that period ends, the credential can no longer be reused. There is no permanent secret left behind to manage, rotate or potentially compromise.
Ephemeral access is only part of the answer
Of course, ephemeral access is not a complete security strategy on its own. Organizations still need visibility into their human and non human identities, clearly defined use cases, granular authorization policies and reliable audit trails.
As discussed during the webinar, the real shift is from managing accounts to governing actions. Privilege is determined by what an identity can do, not simply by what type of identity it is.
AI agents may be changing the scale and speed of machine access, but they do not make established security principles irrelevant. If anything, they make Zero Trust, least privilege and zero standing privileges more important.
The challenge now is applying those principles consistently across every identity interacting with critical systems.
