A cryptographically signed credential is a digital record whose issuer uses a private cryptographic key to sign its contents. A verifier can check that signature using the issuer’s public key, helping confirm that the record is authentic and has not been altered. The credential may state an identity or claims about permissions, but a valid signature alone does not prove that those permissions are appropriate or still current.
In cybersecurity, credentials can help services identify users, software, or AI agents and assess their authority. For an agent credential to act as a control, the system receiving each request must validate it and enforce current policy at runtime, including scope and expiration; organizations also need a way to revoke credentials and audit their use. Attackers may exploit systems that trust stale, stolen, or overly broad credentials. Defenders should protect signing keys, limit credential scope and lifetime, and verify credentials at the point of action.