mtls
AI security interview questions tagged mtls, across every topic.
4 questions · 0 unlocked for you
Concepts behind "mtls"
Explanations of the mechanisms these questions rely on.
Core
Workload Identity and SPIFFE: Identity for Services, Pipelines and AgentsServices, CI jobs and AI agents have traditionally used long-lived stored keys, which leak and outlive their purpose. Workload identity replaces them with short-lived credentials issued after the platform attests what the workload is: Kubernetes projected tokens, OIDC tokens from CI exchanged for cloud credentials, and SPIFFE identities with X.509 or JWT documents for service-to-service mutual TLS. The design questions are which claims a trust policy pins, how attestation roots the chain, and remembering that identity is not authorization: every service still needs policy on what each identity may do. Identity & AccessSign in
Advanced
Sender-Constrained Tokens: DPoP, mTLS and Token ExchangeA bearer token is honoured for whoever presents it, so a leaked token is a working credential. Sender-constrained tokens carry a confirmation claim naming a key, and the resource server checks that the caller proves possession: DPoP with a signed proof per request, mTLS with the client certificate on the connection. Binding stops replay of an exfiltrated token; it does not stop code that runs where the key is, or a forged token. Token exchange (RFC 8693) issues each hop a new, narrower, audience-bound token instead of passing one along. Identity & Access🔒 Premium