SECAI Core · phase 10 of 15
Authentication
A method of validating a particular entity's or individual's unique credentials.
The Explain card
- Plain English
- Authentication is validating that an entity's presented credentials are genuinely theirs. It answers "are you who you claim to be?"
- Example
- An AI agent calling an internal tool presents a signed token issued by the identity provider. The tool verifies the signature and expiry before accepting the request. An attacker replaying an old or forged token is refused.
- Why it matters
- AI systems authenticate in both directions: users to the model, and the model or agent to the tools it calls. Weak authentication on the agent side lets prompt injection turn into real actions against real systems.
- Hook
- Prove it.
Where it sits in the deck
Phase 10: Identity, Access, and Cryptographic Foundations
Before examining threats to systems, establish the foundational security primitives — identity, authentication, authorisation, and the cryptography underpinning them.
