Identity & Trust

The pain

You probably landed on this page because one of these describes you:

• Your organization already has AI agents in production (internal assistants, RAG pipelines, support agents) consuming internal APIs with a shared service account or a long-lived token kept in a secret manager. It works, but you can’t answer “which specific agent did what” when an auditor asks.
• The legacy corporate PKI issues certificates manually, rotates them every 12 months, and nobody knows who last operated the CA. It formally meets the regulation but wouldn’t survive a real audit if someone dug in.
• Workload identity in Kubernetes is half-implemented — some pods use service accounts, others run with static tokens mounted as volumes. The platform team knows it’s wrong but has no bandwidth to migrate to a coherent model.
• Compliance asked for encryption and authentication between microservices. The team replied “we already have mTLS with cert-manager” but the certs are signed by a self-signed CA without rotation policy, without revocation, without attestation of which workload obtained them.
• The security team knows SPIFFE/SPIRE exists and would solve several of these problems, but the cost of learning, deploying and migrating production looks larger than the cost of continuing with current debt.

None of these is a tooling problem — all the components exist open source. It’s a problem of lacking a senior engineer with the combination of applied cryptography + Kubernetes + compliance to design the full architecture and operate it during the cutover.

What CultureTech prepares

A Staff Engineer embedded with the client team for 3-6 months, focused on one of these domains (not all five at once):

• End-to-end workload identity with SPIFFE/SPIRE — Server, agents deployed per cluster, cross-cluster federation, integration with the corporate IdP (Okta, Entra, Keycloak). The output: every workload gets its cryptographic SVID at boot, with no static secrets, with namespace + service account + node identity attestation.
• Agent identity for AI in production — every AI agent (assistant, RAG worker, batch pipeline) has its own cryptographic identity, not a shared token. Calls to internal APIs are authenticated with SVID, not with recyclable bearer tokens. The audit log answers “which agent, which call, which payload” with cryptographic proof.
• Modern auditable PKI — replacement of legacy CAs with SPIRE upstream CA or Smallstep/HashiCorp Vault as delegated CA. Automatic rotation policy, revocation lists that are actually consulted, issuance attestation. Operational documentation written so the bank’s auditor understands it, not just the security team.
• Cross-cluster trust domains — if the organization has clusters across regions, cloud and on-prem, or k8s + VMs, SPIFFE federation enables coherent identity without VPNs or intermediate bastions.
• Compliance evidence engineering — generating the traceability a banking, healthcare or defense auditor will demand. It’s not writing a PDF — it’s instrumenting the system so the report generates itself from real production data.

The engagement delivers code in your repo, manifests in your cluster, operation and rotation runbooks, and your team operating it. No slideware, no “identity strategy.”

Who it’s for

• Organizations in regulated sectors (banking, healthcare, aerospace, defense, GovTech, energy) where compliance isn’t ornamental — Basel III, HIPAA, SOX, Chilean CMF, SBIF/CMF regulation, NIST SP 800-204, ISO 27001 are operational, not aspirational.
• Teams already adopting AI agents that recognize cryptographic identity for each agent will be a requirement in the next 18 months, not optional.
• Platform/security teams with 3-10 senior people who need additional focused capacity — not 3 more mid-level hires, but a short, focused senior intervention on one critical domain.

What it’s not

• Okta / Entra / Auth0 implementation. Those are implemented by the vendor or a certified partner. This practice serves the plane underneath: workload-to-workload, agent-to-API, cross-cluster trust.
• PKI as a service. We don’t sell a SaaS CA. We build PKI inside the client’s infrastructure.
• Compliance audit. That’s done by a certified auditor. What we do is engineer the evidence the auditor will ask for.
• Replacement for the internal security team. It’s an accelerator during the cutover period.

How it crosses the portfolio

• Aether Telemetry — semantic observability of the trust plane. Every issued SVID, every attestation, every mTLS handshake is instrumented with contractual context. Enables answering “which agent did what” with low latency, without reconstructing the audit log by hand.
• AI Governance LATAM — the playbook covering the 4 dimensions to govern AI agents in production. Identity is one of the four; this service implements that dimension in depth.

When it activates

Q3 2026. The service depends on having at least one senior engineer with the specific combination (cryptography + Kubernetes + operational compliance) dedicated full-time to the engagement. Before Q3 2026 that capacity is committed to the initial portfolio launch.

The process: discovery week (no cost) → proposal with scope limited to one domain (workload identity OR agent identity OR PKI modernization, not all three at once) → 3-6 month engagement → documented handoff. No mandatory post-engagement retainer.