SILVER SPRING, Md. – Nov. 11, 2025 – Aembit, the identity and access management platform for agentic AI, today announced at KubeCon + CloudNativeCon North America 2025 support for the SPIFFE JWT-SVID specification, enabling its Workload IAM Platform to provide run-time access enforcement for SPIFFE-compliant services. This advancement helps organizations secure access to sensitive data and resources while reducing the manual, repetitive work often associated with identity and credential management.
When using Aembit with SPIFFE, enterprises reduce risk across the thousands of workloads and AI agents that need access to sensitive data in three key ways. They gain:
- Centralized run-time access enforcement based on policy: While SPIFFE can provide identity or access tokens, it does not inherently give you an access management layer for workloads or AI agents. Aembit provides this centralized control, without a need to change the way you use SPIFFE today.
- Brokering between SPIFFE and non-SPIFFE compliant environments: Aembit acts as an identity broker, with the ability to cryptographically verify identities in non-SPIFFE environments and connect them to SPIFFE trust domains. This provides a single, consistent method to ensure access regardless of the underlying identity framework.
- Zero Trust access management for AI: With Aembit, enterprises can go beyond SPIFFE identity, layering on conditional access criteria that includes workload security posture, time of day, or geography.
As organizations expand across Kubernetes, multi-cloud, and hybrid environments, maintaining consistent enforcement of workload access has become increasingly complex. The challenge now extends beyond traditional services to include agentic AI workloads that autonomously access APIs, data stores, and partner systems – all as enterprises have added SPIFFE to the mix of tools they use for access. Aembit’s SPIFFE integration provides a standards-based way to enable trusted and secure access across diverse environments.
SPIFFE (Secure Production Identity Framework for Everyone) defines open standards for identifying and securing workloads in dynamic environments. Its production-ready implementation, SPIRE, issues and manages those identities. By generating SPIFFE-compliant JWT-SVID tokens directly from within the Aembit Workload IAM Platform, organizations can extend SPIFFE trust to any workload – including AI agents – without duplicating infrastructure.
“Our customers increasingly operate across environments that extend beyond a single trust domain – from managed Kubernetes clusters to third-party SaaS platforms they don’t control,” said Kevin Sapp, co-founder and CTO of Aembit. “By supporting the SPIFFE JWT-SVID specification, Aembit bridges that gap, giving enterprises a flexible, standards-aligned way to connect workloads securely while maintaining centralized policy and enforcing conditional access based on real-time context and posture.”
The new Aembit SPIFFE JWT-SVID Credential Provider allows client workloads to request and present SPIFFE-compliant tokens with minimal configuration, extending standards-based authentication across Kubernetes, cloud, and hybrid environments. It supports dynamic SPIFFE ID configuration and standard signing algorithms, such as RS256 and ES256, while automatically handling verification and token lifecycle management behind the scenes.
This integration gives organizations a practical way to align with open standards without introducing new infrastructure or operational overhead. It’s particularly valuable for enterprises that already use SPIFFE or SPIRE for part of their environment, want to apply Zero Trust and conditional access to those deployments, or aim to centralize logging and policy controls across diverse workload identity approaches.
Aembit’s implementation focuses on issuing SPIFFE-compliant JWTs, extending SPIFFE’s capabilities without requiring SPIRE on every system. It complements existing SPIFFE deployments by improving interoperability and simplifying workload-to-workload access across heterogeneous environments.
For more information, visit aembit.io.
About Aembit
Aembit is the identity and access management platform for agentic AI and workloads. It enforces access based on identity, context, and centrally managed policies, giving organizations a singular place to control access risk from AI agents, automate credential management, and accelerate AI adoption. With Aembit, enterprises can confidently control access to sensitive resources across all the workloads that power their business. Users can visit aembit.io and follow the company on LinkedIn.
Contact
Apurva Davé
Aembit
info@aembit.io