Post-Quantum Cryptography Migration for Agentic AI Systems

Abstract

Agentic AI systems depend on classical public-key cryptography for agent identity, tool invocation, inter-agent communication, model integrity, and persistent state, exposing them to a cryptographically relevant quantum computer (CRQC) along two axes: confidentiality (harvest-now-decrypt-later) and integrity (harvest-now-forge-later). Existing post-quantum migration guidance addresses static, operator-controlled enterprise estates, while emerging agent-identity work omits post-quantum cryptography entirely; neither treats non-human-identity-dense, runtime-negotiated agentic systems as a distinct migration class. This paper develops a conceptual framework that does. It organizes agentic cryptography into seven migration surfaces and separates each identity into a credential layer (symmetric, operator-held, low-risk) and a trust-anchor layer (the asymmetric roots that underwrite the fleet). These layers scale inversely: a small set of trust anchors carries a forge-later blast radius equal to the population beneath it, so migration effort and forge-later risk rank the work in opposite orders. A migration matrix and a parametric effort-and-risk model formalize this, yielding the core sequencing rule: migrate anchors first. Because agentic adoption is ongoing, it also reframes migration from a finite inventory into a continuously regenerating problem, distinguishing remediation of the installed base from prevention of new classical-cryptographic debt in future deployments. It closes with oversight and procurement implications for federal post-quantum readiness.

1. Introduction

Two cryptographic transitions are now underway at once, and they are on a collision course. The first is the migration to post-quantum cryptography (PQC): with the first NIST standards finalized in 2024 (FIPS 203/ML-KEM for key establishment and FIPS 204/ML-DSA and FIPS 205/SLH-DSA for signatures [1,2,3]), the United States has set civilian deadlines, deprecating quantum-vulnerable algorithms by 2030 and disallowing them by 2035 for non-national-security systems (the dates proposed in the Initial Public Draft of NIST IR 8547 [4]), against a federal civilian migration whose cost OMB and ONCD have estimated—as an initial rough-order-of-magnitude projection, not a settled program budget—at roughly $7.1 billion [5]. The second is the rapid operational adoption of agentic AI: in a 2026 survey, 85% of organizations reported running AI agents in production [6]. These transitions are being planned independently: PQC migration as an estate-modernization exercise, agentic AI as a productivity and security-governance problem. Yet they intersect directly, because every networked agent is a dense consumer of exactly the public-key cryptography that PQC migration must replace. And because an adversary can record protected material today and break it once a cryptographically relevant quantum computer (CRQC) exists [7], the migration clock for agentic systems has already started.

Agentic AI systems depend on classical public-key cryptography across their entire operating loop: for agent identity, inter-agent coordination, tool invocation, model integrity, and persistent state. A CRQC threatens these foundations along two distinct axes that this paper keeps separate throughout. The confidentiality axis is harvest-now-decrypt-later (HNDL): ciphertext and recorded sessions collected today become readable once key agreement is broken. The integrity axis is harvest-now-forge-later (HNFL): signatures, certificates, and issuer-signed tokens become forgeable once the underlying signing keys can be recovered. For systems whose identity and authority are established almost entirely through signatures and issued tokens, the forge-later axis is the more consequential, and it is the one the existing literature most neglects.

Neither body of guidance that should cover this case actually does. The post-quantum migration literature (government readiness reporting, NIST practice guidance, and the canonical organizational treatments [8]) assumes a largely static, data-at-rest, operator-controlled estate, and does not treat non-human-identity-dense, runtime-negotiated systems as a distinct class. The emerging agent-identity work, including the NIST NCCoE concept paper on software and AI-agent identity [9], adapts conventional identity and access management to agents but omits post-quantum cryptography entirely. To our knowledge, no prior work treats agentic AI as a post-quantum migration class in its own right; the existing efforts sharpen the gap rather than close it (Section 2.3).

This paper argues that agentic AI changes post-quantum migration in kind, not only in degree. Classical enterprise migration is dominated by static, operator-controlled, data-at-rest cryptography; agentic migration is runtime-negotiated, dependency-coupled, and driven by a non-human identity (NHI) population that vastly outnumbers human users. The sharper structural claim is that the migration burden is layered. Each agent identity decomposes into a credential layer (what the agent holds, largely symmetric and cheap to re-issue) and a trust-anchor layer (the asymmetric issuance, signing, and transport roots that underwrite the whole fleet). These layers scale inversely: a handful of trust anchors carries a forge-later blast radius equal to the entire population beneath it, so the components smallest in number are largest in risk, and they are disproportionately owned by vendors and identity providers rather than the operator. The magnitude of the resulting expansion in migration surface is something this paper models rather than asserts (Section 8).

This paper makes six contributions; the first, third, and sixth are, to our knowledge, novel, and the other three operationalize and ground them:

• A layered migration framework that decomposes each agent identity into an operator-held credential layer and a shared trust-anchor layer and organizes agentic cryptography into seven surfaces, isolating the trust-anchor fan-out (a few asymmetric roots underwriting the entire fleet) as the dominant concentration of forge-later risk;
• A discriminating migration matrix mapping each surface to its primitive class, dominant threat axis (HNDL versus HNFL), exposure layer, cryptographic timing, dependency ownership, and migration difficulty;
• A parametric effort-and-risk model that separates credential-layer and anchor-layer terms with opposite cost and risk curves, yielding the paper’s central result: migration effort and forge-later risk rank the work in opposite orders, so the smallest, highest-leverage set of trust anchors should migrate first;
• A grounded analysis of classical-cryptographic technical debt and a worked HNFL threat scenario in named, current systems (the Model Context Protocol (MCP), agent-to-agent protocols, and model registries);
• Oversight and procurement implications for federal post-quantum readiness, addressed to GAO, NIST, and CISA;
• A reframing of migration into two populations (remediating the installed base versus preventing new classical-cryptographic debt in future deployments) that recasts it as a continuously regenerating problem rather than a finite inventory.

Approach. This is a conceptual, analytical paper: it develops and argues a framework rather than reporting an empirical study, and the choice is deliberate. Agentic AI in production is recent, post-quantum migration of any system has barely begun, and no organization has completed a post-quantum migration of an agentic estate, so there is no population of completed migrations to sample, and an empirical design would have nothing to measure. What a field needs at this stage is a way to structure the problem, identify what must be inventoried and sequenced, and generate testable claims; that is what a conceptual framework provides, and what this paper offers in place of measurement it cannot yet take.

Derivation of the surfaces. The seven cryptographic surfaces were derived analytically by tracing the agent operating loop (Section 2.1) and asking, at each stage, which cryptographic operation the stage depends on and which primitive secures it. Identity issuance, tool invocation, inter-agent messaging, model loading, memory and state, orchestration, and logging and provenance each rest on a distinct cryptographic dependency; grouping by dependency, rather than by component or vendor, yields the seven. The taxonomy is proposed as discriminating and useful, not exhaustive or uniquely correct (Section 13); its test is whether it separates surfaces that migrate differently, which the migration matrix (Section 6) makes explicit.

Evidence. Three kinds of evidence ground the analysis, each used within its limits. Normative and technical sources—the FIPS standards [1,2,3], NIST and GAO guidance [10,11,12], and the protocol specifications the surfaces actually use (OAuth, the Model Context Protocol authorization specification, and the relevant RFCs)—establish what the cryptography is and what it must become. Peer-reviewed and preprint literature [7,8,13] positions the work and supplies the shelf-life and migration models it builds on. Industry telemetry and the CSA practitioner survey [6,14,15,16,17] supply the scale premise; because these are not peer-reviewed and use inconsistent methods, they are treated as a caveated spread rather than measurements (Section 2.4 and Section 13). The parametric model (Section 8) is illustrative by construction: its structure is the claim, its coefficients are placeholders, and only the orderings it produces are asserted.

The remainder of the paper is organized as follows. Section 2 reviews agentic architectures, post-quantum cryptography, the related literature, and the NHI density that motivates the analysis. Section 3 defines the seven cryptographic surfaces, and Section 4 grounds them in the classical cryptography of current systems and their technical debt. Section 5 develops why migration is harder in kind for agentic systems, and Section 6 presents the migration matrix. Section 7 gives a phased roadmap, and Section 8 develops the parametric effort-and-risk model, its worked example, and the timeline implications. Section 9 presents the threat model and the worked forge-later scenario, Section 10 distinguishes remediation of the installed base from prevention in new deployments, Section 11 draws out oversight and procurement implications, Section 12 sets out open research questions, Section 13 states the limitations, and Section 14 concludes.

2. Background and Related Work

2.1. Agentic AI Architectures

An agentic AI system is one in which a language model does not merely generate output but plans and takes actions—invoking tools, calling APIs, querying data, and triggering downstream effects—with limited human supervision, often as one of several agents coordinating toward a goal. Such a system has a recognizable lifecycle: each agent is provisioned with an identity and credentials; it authenticates to tools and services and exercises authority delegated to it; it coordinates with other agents; it persists memory and state across steps; and the model artifacts it runs carry signatures and provenance. Each of these stages rests on cryptography—for authentication, authorization, channel protection, and integrity—which is why the migration surface is broad rather than confined to data at rest. This paper treats the architectural components only at the level needed to locate that cryptography; the cryptographic decomposition is the subject of Section 3, and the named systems that implement it are detailed in Section 4.

2.2. Post-Quantum Cryptography

The post-quantum standards this paper targets are given in FIPS-first form. NIST has finalized FIPS 203/ML-KEM for key establishment [1] and FIPS 204/ML-DSA [2] and FIPS 205/SLH-DSA [3] for digital signatures, with FIPS 206/FN-DSA expected as a further signature option. The two signature families differ in ways that matter for agentic systems: FIPS 205/SLH-DSA is hash-based and deliberately conservative, suiting long-lived signatures such as model checkpoints and provenance whose trust must outlast the migration window, whereas FIPS 204/ML-DSA suits performance-sensitive runtime signing. Both carry practical costs that bear directly on runtime-negotiated cryptography—larger handshakes, larger signatures, and higher verification costs than the classical primitives they replace. In practice, these algorithms are introduced first in hybrid classical-plus-post-quantum modes that hold if either component holds, buying migration time; and the capability they all presuppose is crypto-agility—changing algorithms by configuration rather than re-architecture—which this paper treats as both the central difficulty and the lever for resolving it (Section 5 and Section 7).

2.3. Related Work

This paper sits at the intersection of three bodies of literature that do not currently meet: the post-quantum migration literature, which is mature at the organizational level but assumes conventional estates; the machine-identity and non-human-identity security literature, which documents the scale of the problem but treats it as governance rather than cryptographic migration; and the emerging agentic-AI identity and security literature, which is beginning to take agent identity seriously but addresses only classical threats. The contribution claimed here lives in the gap none of the three occupies.

Post-quantum migration. The canonical organizational treatment is Joseph et al. [8], which frames the transition as an enterprise program—inventory, hybridization, timelines, crypto-agility—and is the work this paper most directly extends. The timing logic underneath it is Mosca’s shelf-life model [7]: migrate before the sum of an asset’s secrecy lifetime and the migration time exceeds the time to a CRQC, which is also the formal basis for HNDL. Government guidance occupies the same conceptual frame—the GAO readiness and coordination assessments [10,11], the NCCoE practice guide SP 1800-38 [12], and the CISA/NSA/NIST quantum-readiness roadmap [18] all organize migration around discovering and prioritizing public-key usage in a largely static, operator-controlled estate. The same emphasis runs through practitioner guidance: the PQC Coalition’s migration roadmap makes building a cryptographic inventory the foundation of the transition [19], and a systematic review of the migration literature finds the practice still immature, with limited PQC experience, high realization effort, and high complexity recurring across reported migrations [20]. None of this body treats runtime-negotiated cryptography, NHI density, or agentic dependency coupling as first-class features of the migration problem; the estate it imagines is human-paced and statically inventoried.

Machine-identity and non-human-identity security. A parallel body of work documents the explosive growth of NHIs and the governance gaps around them—the vendor telemetry surveyed in Section 2.4 (Rubrik [14], Entro [15], Palo Alto Networks [16], CyberArk [17]) and the CSA/Aembit agent survey [6]. This literature establishes that NHIs vastly outnumber human identities and are widely over-privileged and under-governed, but it is industry-sourced rather than peer-reviewed, frames the issue as identity and access management, and never scopes the population to its reliance on quantum-vulnerable cryptography. It supplies the scale premise this paper builds on; it does not connect that scale to post-quantum migration.

Agentic-AI identity and security. The newest and most directly adjacent strand takes agent identity as a distinct problem. The NIST NCCoE concept paper Accelerating the Adoption of Software and AI Agent Identity and Authorization and its companion Request for Information [9,21] adapt OAuth 2.0/OpenID Connect, SCIM, and SPIFFE/SPIRE to agents; CoSAI’s agentic-IAM guidance [22] recommends unique, short-lived, cryptographically bound agent identities; and Hou et al. [13] provide the first academic security analysis of the Model Context Protocol, building a threat taxonomy across the MCP server lifecycle. Tellingly, every one of these treats the relevant threats as classical—tool poisoning, prompt injection, delegation abuse, credential misuse—and none addresses post-quantum cryptography at all. The agent-identity problem is being recognized; its quantum dimension is not.

Prior work in this line. This paper continues a research line on PQC migration and integrity that includes the author’s evaluation of post-quantum distributed-ledger cryptography [23], the treatment of parameter-resident cryptographic material as an unscoped migration surface [24], the synchronization of concurrent security-modernization programs [25], and the Mythos-class detection architecture [26]; the forge-later (HNFL) emphasis and the modernization-synchronization framing developed here extend that prior work.

The gap, stated precisely. The post-quantum literature is organizational and static and is silent on agentic, NHI-dense runtime systems; the NHI literature measures the scale but is not scoped to cryptographic migration; and the agentic-security literature, including its first peer-reviewed entries, treats only classical threats. To our knowledge, no prior work treats NHI-dense agentic systems as a distinct PQC migration class, separates the credential and trust-anchor exposure layers, or models the trust-anchor fan-out that concentrates forge-later risk. The novelty claimed here is the layered credential/trust-anchor framework and its fan-out, the effort-versus-risk inversion the model formalizes (Section 8), and the two-population reframing—not first recognition that post-quantum cryptography and agent identity intersect; the discriminating matrix (Section 6) and the threat scenario operationalize and ground these rather than extend them.

2.4. Machine-Identity Density and the Layered Cryptographic Dependency

Machine-identity density is real and large, but for a post-quantum migration paper, the load-bearing question is not how many NHIs exist; it is where, within the lifecycle of each identity, quantum-vulnerable cryptography actually sits.

No authoritative, agentic-specific ratio exists, and the agentic effect is a multiplier, not a measured ratio. Reported NHI-to-human ratios are vendor telemetry rather than peer-reviewed or governmental measurement, and they span roughly 82:1 to 144:1 across studies that use different denominators, identity definitions, and sampling frames, clustering nearer 80:1 to 110:1 in the larger mainstream enterprise samples (the same survey lineage reports 82:1 in CyberArk’s 2025 edition [17] and ~109:1 in Palo Alto Networks’ 2026 successor edition, published after its acquisition of CyberArk [16]; Rubrik Zero Labs repeats an ~82:1 figure from industry reporting rather than its own telemetry [14]; Entro Labs reports ~144:1 in cloud-native and DevOps environments [15]). These should be cited as a spread with their methodologies noted, never as a single converging constant, and none isolates AI agents as a subpopulation or scopes the count to cryptographic reliance.

The agentic effect is two-directional: agents both multiply and concentrate identities. The defensible claim is therefore not that agents already outnumber humans by some figure, but that agentic adoption acts as a multiplier on the existing NHI-to-human ratio: each agent may require one or more workload identities, API credentials, OAuth tokens, service accounts, or certificates, and multi-agent workflows can instantiate and retire these dynamically. That effect is not purely proliferation, however. A 2026 CSA survey (commissioned by an agentic-IAM vendor; treat as industry-sponsored) reports that 85% of organizations run AI agents in production and that those agents most often operate through workload identities (52%), shared service accounts (43%), or borrowed human user identities (31%)—a multi-select distribution [6]. The same survey finds that 74% of organizations say agents receive more access than necessary and 52% say agents inherit access originally intended for humans or other systems [6], so the borrowing is not incidental but a dominant pattern. The latter modes mint no new distinct identities; they concentrate many agents behind a few shared credentials. So agentic AI simultaneously multiplies identities (new per-agent workload identities and tokens) and concentrates them (shared service accounts and delegated human identities underwriting whole fleets). The concentration direction is the one that matters most here: a single shared service account or issuer standing behind dozens of agents is exactly the high-blast-radius trust anchor whose forge-later exposure this paper’s model treats as the first migration priority (trust-anchor fan-out, below; Section 8).

Why nearly the whole population is in scope. An identity cannot obtain a key or token without an issuance and validation event, and in common deployments of the OAuth 2.1/OpenID Connect stack on which the Model Context Protocol rests, that event is asymmetric end-to-end. The client reaches the authorization server over TLS whose key agreement is ephemeral Diffie–Hellman and whose server authentication is an RSA or ECDSA certificate—both quantum-vulnerable, so the token is transported under recordable, later-decryptable protection. The dominant token form in these deployments, the issuer-signed JSON Web Token (RS256/ES256/PS256), is itself an asymmetric artifact, validated by checking that signature against the issuer public key published at a JWKS endpoint. OAuth/OIDC does not mandate this shape—opaque reference tokens and symmetric HMAC-signed (HS256) JWTs are valid alternatives—but those variants still ride the asymmetric TLS channel and resolve to the same authorization server (by introspection or a shared secret), relocating rather than removing the asymmetric dependency. Sender-constrained variants—mutual-TLS-bound tokens, DPoP, and private_key_jwt client authentication—add further client-held asymmetric keys. Consequently, the gross NHI count is a defensible proxy for the population in migration scope; it is not an overestimate to be discounted. (This withdraws the discount proposed in an earlier draft).

The layered decomposition. Within each identity, there are two separate layers. (a) The credential/runtime layer—what the agent holds and presents—is largely symmetric or hash-based: the raw value of an API key, an HMAC (HS256) token, the PKCE S256 challenge, and session keys after derivation. This layer faces only Grover-class pressure and is not the migration driver. (b) The issuance/validation/transport layer—how the credential is born, carried, and checked—is asymmetric and is the migration target: certificate authentication, ephemeral key agreement, and issuer/CA signing keys. Harvest-now-decrypt-later (HNDL) bites the transport sublayer (recorded token-bearing sessions, decryptable later); HNFL bites the issuance and signing sublayer (forgeable issuer and CA keys yield forged agent tokens and impersonation at scale).

Trust-anchor fan-out (the inversion). The two layers scale inversely. A small number of asymmetric trust anchors—certificate-authority roots, the authorization server’s token-signing keys, JWKS keys, SPIFFE trust bundles—underwrite an enormous number of NHIs (Figure 1). Migration effort at the anchor layer is therefore sub-linear in identity count, but the HNFL blast radius of any single unmigrated anchor equals the full population of identities it signs for. An unmigrated issuer key is a single point of forge-later catastrophe for the entire agent fleet beneath it. This inversion, not a head-count, is the quantity the migration model must capture (Section 8), and it concentrates the highest-leverage exposure in exactly the components an operator least controls—the OAuth authorization server, the public CA, the cloud key-management service (Section 5.2).

Figure 1. Trust-anchor fan-out: a few asymmetric anchors underwrite the whole NHI fleet, so a single unmigrated anchor’s forge-later blast radius equals the population it signs for. This figure carries the quantitative fan-out and blast-radius relationship and the concentration of exposure at the anchor layer; the operating-loop-to-surface taxonomy is the separate role of Figure 2.

Figure 1. Trust-anchor fan-out: a few asymmetric anchors underwrite the whole NHI fleet, so a single unmigrated anchor’s forge-later blast radius equals the population it signs for. This figure carries the quantitative fan-out and blast-radius relationship and the concentration of exposure at the anchor layer; the operating-loop-to-surface taxonomy is the separate role of Figure 2.

Figure 2. The agent operating loop and its seven cryptographic surfaces, annotated with each surface’s dominant threat axis (HNDL/HNFL). The credential versus anchor exposure layer is carried by Figure 1 and the migration matrix of Section 6.

Figure 2. The agent operating loop and its seven cryptographic surfaces, annotated with each surface’s dominant threat axis (HNDL/HNFL). The credential versus anchor exposure layer is carried by Figure 1 and the migration matrix of Section 6.

3. Cryptographic Surfaces in Agentic AI

Agentic AI introduces no new cryptographic primitives; it redistributes existing ones across a wider and more runtime-exposed set of surfaces. This section defines seven such surfaces (Figure 2) and, for each, identifies the primitive at risk, the dominant threat axis—HNDL (confidentiality) versus HNFL (integrity)—and whether the exposure sits in the operator-held credential layer or the shared trust-anchor layer (Section 2.4). The surfaces are not disjoint: model integrity, orchestration, and provenance all rest on signing and overlap at the edges; where they couple, the coupling is named rather than hidden. Together, they form the migration scope that Section 6 tabulates and Section 8 quantifies. The contribution is therefore organizational and analytical rather than a new primitive: proposing a new identity or signature protocol is out of scope, and the novelty claimed is the treatment of agentic systems as a distinct post-quantum migration class, with the analysis built on the OAuth and SPIFFE architectures that are actually deployed. The stage-by-stage derivation is given in

Table 1. Surface derivation: Each agent operating-loop stage maps to the cryptographic surface it produces, the primitive class that secures it, and its dominant threat axis. Grouping by cryptographic dependency, rather than by component or vendor, yields exactly the seven surfaces defined in this section.

Operating-Loop Stage	Cryptographic Surface	Primitive Class	Dominant Axis
Identity issuance	Agent identity	Issuer or CA signature	HNFL
Tool invocation	Tool invocation	OAuth or JWT token signature	HNFL
Inter-agent messaging	Inter-agent communication	KEM plus peer-authentication signature	HNDL plus HNFL
Model loading	Model integrity	Registry or keyless signature	HNFL
Memory and state	Memory and state	Symmetric encryption plus KMS key-wrap	HNDL
Orchestration	Orchestration	Workflow or DAG signature	HNFL
Logging and provenance	Long-lived data and provenance	Signature plus symmetric	HNDL plus HNFL

.

Agent identity. Every agent that authenticates to anything must hold an identity credential that was issued to it and is validated on use. In current practice, these are SPIFFE/SPIRE SVIDs, cloud workload identities (managed identities, IAM roles, service-account keys), or OAuth client credentials, with attestation binding the credential to a workload or node. The credential the agent presents is often short-lived and symmetric-or-hash-based, but it is issued and validated against an asymmetric signing key—an identity-provider or certificate-authority root—and that anchor is the quantum-vulnerable component. The dominant axis is therefore HNFL: a CRQC that recovers an issuer signing key forges identities for the entire fleet beneath it, not merely one agent. Because the anchor is typically shared with and operated by an identity provider (IdP) or cloud provider, this surface is both high-blast-radius and externally timed (Section 5.2)—the reason the matrix rates it anchor-layer, HNFL, runtime, and high-difficulty.

Inter-agent communication. When agents negotiate and exchange messages directly—over service-mesh mTLS, gRPC, or emerging agent-to-agent protocols—they establish session keys and authenticate peers at runtime. Key agreement today is ephemeral Diffie–Hellman and peer authentication is an RSA or ECDSA certificate, so this surface carries both axes at once: recorded sessions are HNDL-exposed (decryptable once the key agreement is broken) and the certificate/CA path is HNFL-exposed (forgeable peer identities). It is distinguished from tool invocation by symmetry—both endpoints are agents negotiating as equals rather than a client presenting a token to a service—and it is the least standardized surface: the core Model Context Protocol is silent on server-to-server authentication, and the Agent2Agent (A2A) effort that fills the gap is still maturing (Section 4.1). A surface with no stable standard cannot be migrated to a post-quantum target that does not yet exist, which is why the matrix marks it as under-standardized as well as high-difficulty.

Tool invocation. This is the surface where an agent exercises delegated authority—calling an API, a database, or an SaaS platform—and it is dominated by the OAuth 2.1/OpenID Connect token flow on which the Model Context Protocol authorization model rests (Section 4.1). The agent presents a bearer- or sender-constrained token; in the common issuer-signed JWT pattern, the resource server validates it against the authorization server’s signing key, and in the opaque-token alternative it introspects the token at the authorization server—either way, the trust roots in the same vendor-held anchor. As with agent identity, the token may be short-lived but the issuer key that underwrites every token is a long-lived asymmetric anchor, making the axis HNFL and the exposure anchor-layer. What sets this surface apart is ownership: the authorization server and the SaaS resource servers are vendor-operated, so the operator can inventory the dependency but cannot set its migration timeline—the matrix records it as vendor-owned, and Section 5.2 treats that externality as the binding constraint.

Model integrity. Model weights, checkpoints, and artifacts are signed with classical elliptic-curve schemes—key-based signing (e.g., Ed25519) or sigstore-style keyless signing, in which a Fulcio-issued short-lived certificate binds an OIDC identity to an ephemeral key (commonly ECDSA P-256), with transparency-log inclusion; the algorithm varies by ecosystem and tooling, so that a consumer can verify a model came from its claimed publisher and was not tampered with. Whatever the variant, the signature chain is the quantum-vulnerable element and the axis is HNFL: an adversary able to forge the registry signing key—or, in keyless flows, the certificate-authority root and identity-provider keys that underwrite the certificates—post-CRQC can substitute a poisoned model that still verifies. This surface differs from the runtime surfaces in timing—signing happens once, at publish time—but verification must keep succeeding for as long as the model is deployed, which can be years, so the signature’s effective exposure window is the deployment lifetime, not the signing instant. Because a registry signing root underwrites every artifact it serves, this too is an anchor-layer surface, though its static timing and partially operator-controlled registry make it medium rather than high difficulty.

Memory and state. Agents persist state—vector databases and embeddings for retrieval, conversation and tool-call logs, and cached intermediate results—and that data is encrypted at rest, typically with symmetric AES-GCM under keys wrapped by a cloud KMS (envelope encryption). This is the paper’s clearest HNDL surface and its clearest credential-layer surface: the at-rest data is confidentiality-exposed, the key-wrapping step uses asymmetric or KEM mechanisms that a CRQC threatens, and the exposure is operator-controlled rather than vendor-gated. Its severity is governed by secrecy lifetime—embeddings derived from sensitive corpora and retained logs can carry multi-year confidentiality requirements, so ciphertext harvested today remains valuable when a CRQC arrives. The matrix rates it HNDL, credential/data-layer, static, self-owned, and medium difficulty precisely because the operator both holds the risk and controls the fix.

Orchestration. Multi-step agent workflows are increasingly expressed as execution graphs—DAGs of tool calls, sub-agent invocations, and conditional branches—and the integrity of that control flow can be signed so that a step cannot be injected, reordered, or replayed. This is distinct from provenance: orchestration integrity attests to what the system is authorized to execute now (control-flow authenticity), whereas provenance attests to what happened in the past (historical record). The signing key over workflow definitions is the asymmetric anchor and the axis is HNFL—forged workflow signatures let an adversary inject execution steps—while the signed-and-stored graph also has a static, at-rest aspect, giving the surface a runtime-plus-static timing. It is largely self- or platform-owned, placing its difficulty between the operator-controlled credential surfaces and the vendor-gated identity and tool surfaces.

Long-lived data and provenance. Audit trails, provenance attestations (in-toto/SLSA-style), and retained compliance artifacts carry the longest exposure windows in the system, and they carry both axes at once. As confidentiality-bearing retained data they are HNDL-exposed; as signed attestations that must remain verifiable across a retention lifetime of potentially decades, they are HNFL-exposed, and a forged historical attestation is uniquely corrosive because it rewrites the record used to investigate every other failure. This surface spans both exposure layers—the provenance signing anchor and the data itself—and is where the gap between when material is created and when it must still be trusted is widest, which is why the matrix marks its window the longest and its difficulty high despite static timing.

Scope and overlap. These seven surfaces expand migration scope relative to classical enterprise systems for two structural reasons the rest of the paper develops: several operate at runtime rather than over data at rest (Section 5.1), and several root in trust anchors that vendors or identity providers—not the operator—control (Section 5.2). They also overlap by design: agent identity, tool invocation, model integrity, orchestration, and provenance are all signature surfaces underwritten by a small number of asymmetric anchors, which is exactly why the trust-anchor fan-out of Section 2.4 dominates the analysis. Section 6 tabulates the seven against primitive, threat axis, exposure layer, timing, ownership, and difficulty; Section 8 models the magnitude.

4. Classical Cryptography in Current Agentic AI

4.1. Embedded Classical Crypto—Grounded in Named Systems

• Transport: TLS 1.2/1.3 across agent and tool channels (ephemeral Diffie–Hellman key agreement; RSA/ECDSA certificate authentication) [27].
• Tool invocation: The Model Context Protocol authorization model (current stable revision 25 November 2025; the 18 June 2025 update introduced the OAuth-Resource-Server model) is OAuth 2.1 + PKCE [28]; MCP servers are OAuth Resource Servers, with clients implementing Resource Indicators (RFC 8707) [29] and servers exposing Protected Resource Metadata (RFC 9728) [30]. Bearer tokens root in classical TLS/PKI and classical signatures—a concrete instance of the tool-invocation surface.
• Identity/auth tokens: OAuth [31], bearer-token usage [32], JWT (issuer-signed, JWKS-validated), mTLS.
• Model signing: Classical elliptic-curve signatures—key-based (e.g., Ed25519) or sigstore-style keyless flows (Fulcio certificates, OIDC identity, commonly ECDSA P-256, transparency logs), varying by ecosystem.
• Inter-agent gap: The core MCP specification is intentionally silent on server-to-server (agent-to-agent) authentication; that surface is handled by separate, less-mature efforts (e.g., the A2A protocol) [33]. Inter-agent communication is thus not merely unmigrated but under-standardized, strengthening the migration-difficulty claim beyond “hybrid required.”
• Service mesh: Cloud-native meshes (e.g., Istio, Linkerd) terminate mTLS in sidecar proxies and issue workload identities through SPIFFE/SPIRE as short-lived X.509 SVIDs (and JWT-SVIDs), so every workload-to-workload call roots in a SPIFFE trust bundle that acts as an asymmetric trust anchor.

No public benchmark quantifies the share of agents that “use cryptography.”

Table 2. Representative agent deployments and their classical-crypto dependencies.

Agent Type	Typical PQC-Relevant Asymmetric Dependency	Why
Local demo agent (no external tools, no network)	Effectively none at the agent layer	No TLS handshake and no issuer-signed tokens; only host/OS platform cryptography, which the agent itself does not invoke.
Chatbot/assistant on hosted model APIs	Effectively universal in typical networked deployments (transport)	Every model/API call performs a TLS handshake—ephemeral Diffie–Hellman plus an RSA/ECDSA server certificate—regardless of the agent’s own credential type.
Enterprise tool-using agent (SaaS, DB, cloud, email, repos)	Effectively universal in typical networked deployments	TLS transport plus, in common deployments, issuer-signed OAuth/OIDC tokens (RS256/ES256/PS256), often mTLS or workload certificates; asymmetric at transport and, in issuer-signed deployments, at issuance and validation.
Mature zero-trust/multi-agent workflow	Universal in the target architecture	Cryptographically bound, short-lived, verifiable agent identities with signed claims, e.g., code/model signatures [22].

instead infers, by deployment pattern, the share whose dependency is on quantum-vulnerable asymmetric primitives—the population PQC migration actually targets. The key point: A networked agent’s asymmetric exposure comes from the TLS handshake and issuer-signed tokens even when its own credential is a symmetric API key, so the dependency is effectively universal for any agent that leaves its host.

Deployment-pattern inference is not a measured statistic; percentages denote how universally the agent class touches quantum-vulnerable asymmetric cryptography somewhere in its execution path, not a surveyed figure.

4.2. Cryptographic Technical Debt

Cryptographic technical debt is the accumulated set of design and operational choices that make classical primitives costly to replace later, and current agentic stacks carry it in concentrated form. Algorithms are often hard-coded into application logic rather than negotiated, and the libraries beneath them are frequently not crypto-agile, so replacing a primitive becomes a re-architecture rather than a configuration change. Keys are long-lived, which lengthens the window in which harvested material stays valuable, and protocols differ enough in their migration paths that they cannot be cut over together (Section 5.4). Compounding these, many of the most consequential dependencies are third-party, with migration timelines the operator can influence but not set (Section 5.2). Unrotated credentials are endemic at agent scale: in the 2026 CSA agent survey, 33% of organizations did not know how often AI-agent credentials are rotated [6], so the long-lived-key component of the debt compounds precisely where churn is highest.

4.3. Harvest-Now Exposure—Two Axes

• HNDL: Confidentiality exposure of harvested ciphertext—agent logs, memory stores, training data, model artifacts, and recorded token-bearing transport sessions.
• HNFL: Integrity/authenticity exposure—captured signed material (agent credentials, issuer/CA signing keys, model-checkpoint signatures, provenance attestations) becomes forgeable once a CRQC exists. For agentic systems, whose identity and integrity surfaces are signature-based and underwritten by shared trust anchors, HNFL is arguably the dominant axis (extending the parameter-resident/MBOM-PQC (model bill of materials) line of prior work [23,24]).

5. Why PQC Migration Is Harder for Agentic AI

Agentic migration differs from classical enterprise migration in kind, not merely in degree. Five properties drive the difference, and several map directly onto the amplification factors of the model in Section 8—runtime negotiation, dependency coupling, identity churn, protocol diversity, and long-lived state. The first is the sharpest, because it is the property most absent from the classical, data-at-rest migration that the existing literature assumes.

5.1. Runtime, Negotiated Cryptography

Classical enterprise migration is dominated by data-at-rest and relatively static channels. Agentic systems perform cryptographic operations during execution and negotiate algorithms and trust at runtime—key establishment, message signing, tool authentication, and identity issuance happen inside the agent’s operating loop. Migration therefore touches live negotiation paths, not just stored artifacts, and a post-quantum change can alter latency, handshake size, and failure modes on the critical path of every agent action rather than in a background re-encryption job. This is the property the model carries as the runtime factor, and it is what most distinguishes agentic migration from the static estate the prior literature assumes.

5.2. Multi-Agent Dependency Coupling

Migration timelines are gated by parties the operator does not control: cloud providers, SaaS/tool APIs (e.g., MCP server operators), model registries, and tool vendors—a synchronization problem across concurrent modernization programs [25]. The trust anchors identified in Section 2.4—authorization-server signing keys, public CAs, cloud KMS—are disproportionately vendor- or IdP-owned, so the highest-blast-radius components are precisely the ones whose timeline is external. Inter-agent protocols (A2A and successors) are still maturing, so some surfaces lack a standard to migrate to. The dependency reaches into hardware: even an anchor key the operator nominally controls cannot move to a post-quantum signature until the HSM or TPM protecting it ships firmware that implements the new algorithms, and that firmware timeline is set by the device vendor. This externality is what the model isolates in the dependency factor and the anchor-externality cross term (Section 8): the components that most need migrating first are the ones the operator can least compel. Because the operator cannot set these external timelines itself, the policy lever is contractual: embedding post-quantum readiness into the standard procurement language for AI and agent systems would give it reach over the vendor-owned anchors otherwise beyond its control, the response this paper develops in Section 11.6.

5.3. High-Churn Non-Human Identities

Agents are created and destroyed constantly—per task, per session, or under autoscaling—so the quantity that drives migration load is not the steady-state identity count but the rate at which identities and their keys are issued and re-issued. Every new identity requires a freshly issued credential and an attestation binding it to a workload, and under post-quantum primitives each such event invokes signing and verification with the larger keys, larger signatures, and higher verification cost noted in Section 2.2. Classical enterprise estates churn at human pace; agentic estates churn at machine pace, so the same migrated primitive is exercised orders of magnitude more often and the issuing anchors are under continuous rather than occasional load. This is the churn factor of Section 8—the reissues-per-identity-per-year term that separates scenario A (low churn) from scenario B (high churn) in the worked example.

5.4. Protocol Diversity

Agentic systems speak many protocols at once—REST and HTTPS to tools, gRPC inside service meshes, event and message-bus streams, and the emerging agent-to-agent protocols—and each carries its own transport stack, certificate handling, token format, and crypto-agility maturity. Migration cannot be a single coordinated cutover; it must proceed protocol by protocol, and the least-agile protocol gates the path it sits on, since a chain is only as migratable as its stiffest link. Some protocols negotiate algorithms cleanly—TLS 1.3 already admits hybrid key-exchange paths—while others hard-code primitives or expose no negotiation hook and so require re-architecture rather than configuration. The inter-agent protocols are the worst case (Section 4.1): not merely unmigrated but under-standardized, so there is as yet no agreed post-quantum target to migrate them to. This heterogeneity is a direct driver of crypto-agility cost and of the surface count the model carries.

5.5. Long-Lived State

Agentic systems accumulate large, durable state—vector stores and embeddings, conversation and tool-call logs, training and fine-tuning corpora, and provenance and audit trails—much of which must remain confidential or verifiable for years. Two costs follow. First, re-encrypting at-rest data under post-quantum key-wrapping is a bulk operation whose cost scales with data volume rather than identity count, and embeddings in particular are large and continually regenerated. Second, and more consequential, this is where the harvest-now exposure windows are longest: data whose secrecy lifetime extends past the arrival of a CRQC is exposed to HNDL today, and signed provenance that must stay verifiable across a multi-year or multi-decade retention horizon is exposed to HNFL (the long-lived-data surface of Section 3). Long-lived state is therefore both an expensive migration task and the surface where the cost of deferral compounds fastest—the place where Mosca’s shelf-life inequality [7] bites first.

6. PQC Migration Matrix for Agentic AI

Threat axis: HNDL = decrypt-later (confidentiality); HNFL = forge-later (integrity). Exposure layer locates the dominant quantum-vulnerable component: credential (what the agent holds, largely symmetric/at-rest) versus anchor (the asymmetric issuance/signing/transport root that underwrites many identities). Dependency ownership = who controls the migration timeline. The full matrix is given in

Table 3. Migration matrix for the seven cryptographic surfaces.

Surface	Primary Primitive at Risk	Dominant Threat Axis	Exposure Layer	Crypto Timing	Dependency Ownership	Migration Difficulty
Agent identity	Signature (FIPS 204/ML-DSA or FIPS 205/SLH-DSA)	HNFL	Anchor (issuer/CA signing)	Runtime	Shared (self + IdP/cloud)	High
Inter-agent comms	KEM + signature (FIPS 203/ML-KEM + FIPS 204/ML-DSA)	HNDL + HNFL	Anchor (cert/CA) + transport	Runtime (negotiated)	Shared, under-standardized	High
Tool invocation	OAuth/JWT token signature (AS key, JWKS-validated), distinct from TLS/PKI transport	HNFL	Anchor (AS signing key)	Runtime	Vendor (MCP servers, SaaS)	High
Model integrity	Signature (Ed25519/ECDSA → FIPS 204/ML-DSA or FIPS 205/SLH-DSA)	HNFL	Anchor (registry signing root)	Static	Shared (registry + self)	Medium
Memory/state	Symmetric encryption; KMS wrapping/transport may involve asymmetric or KEM components	HNDL	Credential/data (keys at rest)	Static	Self	Medium
Orchestration	Signature (workflow/DAG signing)	HNFL	Anchor (workflow signing key)	Runtime + static	Self/platform	Medium-High
Long-lived data & provenance	Signature + symmetric	HNDL + HNFL	Both (provenance anchor + data)	Static	Self	High (longest window)

.

Reading the exposure-layer column. Anchor-layer rows are few in number but carry a blast radius equal to the population of identities beneath the anchor, and most are vendor- or IdP-owned (Section 5.2). Credential-layer rows are numerous but individually low-severity and operator-controlled. Migration sequencing should therefore prioritize the anchor-layer rows despite their small head-count. This matrix is the migration blueprint and the reference structure for the roadmap in Section 7.

7. Migration Roadmap for Agentic AI

The roadmap operationalizes the migration matrix (Section 6) and the sequencing rule the model produces (Section 8): order the work by forge-later blast radius, not by head-count or by raw effort. It proceeds in three phases—discovery, hybridization, and PQC-native operation—and the defining move, in the second phase, is to migrate the trust anchors before the credential fleet they underwrite.

7.1. Phase 1—Discovery and Inventory

Discovery for an agentic estate must inventory two things that conventional cryptographic inventories conflate or omit. The first is the NHI population itself—the agents, workload identities, service accounts, and tokens in use—which most organizations cannot yet fully enumerate (the measurement gap of Section 12). The second, and the one that determines risk, is the set of asymmetric trust anchors that underwrite that population: the certificate-authority roots, authorization-server token-signing keys, JWKS keys, SPIFFE trust bundles, and model-registry signing roots, together with which identities each anchor signs for. This anchor-to-population mapping is the inventory output the model most needs—it is the b_i term of Section 8.2—and the one current tooling least often produces. Independent guidance reaches the same ordering: the PQC Coalition’s migration roadmap likewise places inventory and prioritization first, as the bottleneck that gates everything downstream [19]. Phase 1 also maps the seven surfaces (Section 3), classifies long-lived data by its HNDL and HNFL exposure window, and flags the non-agile and vendor-gated components whose migration timeline the operator does not control, the externality the model carries as d.

7.2. Phase 2—Hybridization (Anchors First)

Hybridization introduces post-quantum primitives alongside their classical counterparts so that a session or signature holds if either does, buying migration time without a flag-day cutover. The agentic surfaces take their natural targets: FIPS 204/ML-DSA or FIPS 205/SLH-DSA signatures for agent identity, tool-invocation token issuance, and model signing, and FIPS 203/ML-KEM hybrid key establishment for inter-agent and transport channels—FIPS 205/SLH-DSA’s conservative hash-based design suiting long-lived signatures such as model checkpoints and provenance, and FIPS 204/ML-DSA suiting performance-sensitive runtime signing (Section 2.2). Sequencing is by exposure layer, not by population: migrate the anchor-layer signing roots first, because a single unmigrated issuer or CA key is a fleet-wide forge-later catastrophe (Section 2.4 and Section 9.3); then re-encrypt the longest-window HNDL data, whose secrecy lifetime is most likely to outlast the arrival of a CRQC; and only then work through the credential fleet, which is numerous but individually low-severity and operator-controlled. Because the highest-leverage anchors are disproportionately vendor- or IdP-owned (Section 5.2), this phase is as much a procurement and coordination exercise as an engineering one: where the operator cannot migrate an anchor directly, the levers are cross-signing, demanding a hybrid issuance path, and making the vendor’s post-quantum roadmap a contractual gate (Section 11).

Technical fallback for vendor-owned anchors. Where the operator cannot migrate a vendor- or IdP-owned anchor on its own schedule, three technical mechanisms reduce exposure without waiting on the external timeline, and they complement rather than replace the contractual lever. First, cross-signing and hybrid issuance let a relying party accept either a classical or a post-quantum chain during the transition, so the operator is not gated on a single vendor root. Second, an operator-held standby post-quantum signing root provides a break-glass issuance path under the operator’s control that can be promoted if the vendor anchor’s migration lags, bounding the operator’s dependence on an external timeline. Third, a post-quantum-terminating gateway or sidecar proxy interposes operator-controlled post-quantum protection in front of a not-yet-migrated vendor endpoint, extending the service-mesh sidecar pattern of Section 4.1. These are design-level options; a reference sidecar transformation and a full negotiation specification are left to future work (Section 12).

7.3. Phase 3—PQC-Native Operation

The final phase retires the classical primitives once the hybrid period has de-risked the transition: full FIPS 203/ML-KEM key establishment and FIPS 204/ML-DSA or FIPS 205/SLH-DSA signatures across the surfaces, PQC-native orchestration and provenance, and decommissioning of the classical algorithms the hybrid modes kept alive. The durable goal is not a single end-state but crypto-agility—building algorithm negotiation into the runtime so that the next transition, whether to a future standard or away from an algorithm later found weak, is a configuration change rather than a re-architecture. For systems whose cryptography is negotiated at runtime (Section 5.1), that agility is what converts a decade-long migration program into a routine operational capability, and it is the lever that Section 2.2 and Section 5 identify as both the problem and the solution.

8. Cost, Complexity, and Timeline Model

This section presents a parametric structure for estimating agentic migration effort and forge-later risk relative to a classical baseline; the scenarios are illustrative and the coefficients are pending calibration, and no specific magnitude or year-count is asserted as a finding. Its contribution is the factor decomposition—especially the separation of credential-layer and anchor-layer terms with opposite cost and risk curves—and the sequencing rule that follows from it.

8.1. Parametric Effort Model

Express agentic migration effort relative to a classical enterprise baseline as a product of named amplification factors—splitting the former identity factor into a credential term and a trust-anchor term—with an explicit cross term that couples anchor blast radius to dependency externality:

E_agentic = E_baseline × (f_cred × f_anchor × f_churn × f_surface × f_depend × f_runtime) × (1 + Δ)

Δ = γ · (b_max/N) · d

with all factors ≥ 1, each reducing to 1 in the classical limit:

• f_cred—Credential/runtime population term: Scales with the NHI population (the vendor range of Section 2.4 as an upper-bound proxy, expressed as a range). Captures distribution, rotation, and re-issuance of agent-held credentials. Because this layer is largely symmetric/hash-based, its PQC weight derives mainly from re-binding credentials to post-quantum issuance and transport, not from the credential value itself: per-unit burden is low but volume is high, so this term grows roughly linearly with identity count.
• f_anchor—Trust-anchor term: Scales with the number and reuse breadth of asymmetric trust anchors (CA roots, authorization-server signing keys, JWKS keys, SPIFFE trust bundles). Effort is sub-linear in identity count (few keys), but each anchor carries an HNFL blast radius equal to the population it underwrites, and these anchors are disproportionately vendor- or IdP-owned (couples to f_depend). This term, not f_cred, concentrates catastrophic forge-later risk.
• Opposite curves: f_cred and f_anchor move oppositely with respect to identity count—credential-layer effort rises with the fleet while anchor-layer effort stays small but its risk weight rises with the fleet. The model must not collapse them: a fleet can be cheap to re-credential yet catastrophically exposed through a handful of unmigrated anchors.
• f_churn—Key/identity ephemerality (re-issuance and attestation load). f_surface—Count and coverage of the seven surfaces in scope. f_depend—Dependency depth and externality (fraction of surfaces, especially anchors, whose timeline is vendor-/peer-controlled). f_runtime—Fraction of cryptographic operations that are runtime-negotiated rather than static.
• Δ—Anchor-externality cross term, γ · (b_max/N) · d, where b_max/N is the fraction of the fleet underwritten by the single largest trust anchor (its normalized blast radius) and d is the externality fraction. It corrects the independence assumption between blast radius and ownership: it is near zero when no anchor dominates the fleet (b_max/N → 0) or when crypto is operator-controlled (d → 0), and rises only when catastrophic blast radius sits in externally owned anchors. It is bounded by γ (its ceiling, reached only when the entire fleet roots in a single fully external anchor), so the correction stays small outside that pathology. γ is an illustrative coupling coefficient (here 0.5), calibratable like the others; per-anchor ownership weights b_max/N by that anchor’s own externality where the inventory records it, falling back to the aggregate d otherwise.

E_baseline is anchored to the established enterprise-PQC-migration literature—for the federal case, the OMB/ONCD rough-order estimate of roughly $7.1B for civilian-agency migration through 2035 [5] is the cleanest available decade-scale figure, cited as an external estimate rather than presented as a finding of this paper. The contribution is the structure and the factor decomposition; coefficient calibration is identified as future work and as a sensitivity analysis, not presented as settled numbers. The category of this baseline is acknowledged: the roughly $7.1B figure is a civilian-estate rough-order estimate, and using it to anchor an agentic-estate multiplier is a deliberate approximation. It fixes only the order of magnitude of the classical baseline against which the relative multiplier is expressed; the model asserts the multiplier and the orderings it produces, not an absolute agentic-estate cost.

Remaining independence caveat. With the b_max × d interaction now carried explicitly as Δ, the multiplicative core still treats its six factors as independent, which is a first-order approximation: churn and runtime fraction interact (ephemeral, runtime-negotiated identities amplify each other), and f_depend partially overlaps the externality that Δ also uses. These lower-order interactions are left for calibration to resolve—if a regression shows them material, add the corresponding cross terms—rather than being pre-specified here. The Δ term is included because the blast-radius/externality coupling is the one interaction large enough to change the sequencing decision.

8.2. Illustrative Worked Example

The α values below are arbitrary placeholders chosen only to exercise the model; none is empirical and no magnitude is a finding. The purpose is to demonstrate the model’s behavior—in particular the opposite cost and risk curves of the credential and anchor layers. The count-driven factors use log₁₀ deliberately: raw credential-migration work grows roughly linearly with fleet size, but its amplification over a baseline that already automates identity management grows sub-linearly as tooling amortizes. Linear-versus-log is itself the first calibration decision.

Each factor is driven by one observable from the Phase 1 inventory and a single fitting coefficient (

Table 4. Amplification factors: form, inventory input, and illustrative coefficient.

Factor	Form	Input (from Inventory)	Illustrative α
fcred	1 + αc · log10(ρ)	ρ = NHI:human ratio	0.5
fanchor	1 + αa · log10(A)	A = distinct asymmetric trust anchors	0.4
fchurn	1 + αr · r	r = key reissues/identity/year	0.1
fsurface	1 + αs · (s/7)	s = surfaces in scope (of 7)	0.6
fdepend	1 + αd · d	d = fraction with external timeline	0.8
fruntime	1 + αq · q	q = fraction runtime-negotiated	0.7

):

Two scenarios hold the fleet constant (ρ = 100) so the contrast is topology, not size: A, a centralized OAuth/OpenID Connect deployment whose tokens root in a handful of shared anchors, and B, a distributed SPIFFE/SPIRE workload-identity mesh with many small anchors and high credential churn (

Table 5. Inputs for the two illustrative topologies.

Input	A—Concentrated-Anchor	B—Distributed-Credential
Fleet ratio ρ (NHI:human)	100 (50,000:500)	100 (50,000:500)
Trust anchors A	6	1500
Churn r (reissues/id/yr)	4	12
Surfaces in scope s (of 7)	6	6
External-timeline fraction d	0.7	0.3
Runtime fraction q	0.6	0.8

). Because ρ is held at 100 in both, f_cred evaluates to 2.00 in each scenario, so the credential term is constant across A and B, contributes nothing to the contrast between them, and is retained only to anchor the baseline magnitude; the contrast is carried by the anchor, churn, dependency, and runtime terms and by the cross term. Read as use cases, A is the operator running tool-using agents behind a single vendor OAuth authorization server, and B is the operator running a self-hosted SPIFFE and SPIRE mesh; in each, the operator collects the Phase 1 inventory inputs of Table 5, computes the adjusted effort (

Table 6. Computed factors and cross-term-adjusted effort for the two scenarios.

Factor	A	B
fcred	2.00	2.00
fanchor	1.31	2.27
fchurn	1.40	2.20
fsurface	1.51	1.51
fdepend	1.56	1.24
fruntime	1.42	1.56
Product (independent core)	12.3×	29.3×
bmax/N (anchor concentration)	1.00	0.003
Δ = γ · (bmax/N) · d · (γ = 0.5)	0.35	0.00
E*adj  = product × (1 + Δ)	16.6×	29.3×

), and reads the sequencing output (

Table 7. Forge-later exposure and sequencing for the two scenarios. All values are illustrative outputs of the assumed exposure distributions in the Section 8.2 worked example, not empirical measurements.

Forge-Later Exposure & Sequencing	A—Concentrated	B—Distributed
Worst single-anchor blast radius	50,000 (the AS issuer key)	~150 (one namespace)
Share of total risk in top anchor	80%	0.3%
Anchors to retire 90% of risk	2 of 6	870 of 1500
Binding constraint	external control of a few critical anchors	throughput/automation across the fleet
First move	rotate/cross-sign the issuer & CA keys now	industrialize credential + anchor rotation

) to decide its first move.

Applying the equation of Section 8.1 (Table 6):

Before the cross term, B is roughly 2.4 times harder than A. The interaction Δ then adds 35% to A’s effective effort—its entire fleet roots in a single externally owned issuer key, so b_max/N = 1.0 and d = 0.7—while barely touching B, narrowing the effective-effort gap to about 1.8×. The cross term thus pulls part of the concentrated-external exposure into the effort estimate, a first-order nudge toward the risk ranking; it does not replace the separate forge-later exposure metric below, which remains the sequencing key.

Effort is the wrong sort key. The companion output is forge-later exposure: for each unmigrated anchor i, R_i = b_i · e_i (blast radius × externality), dominated by concentration (Table 7).

These exposure figures—the 80% top-anchor share, the 2-of-6 sequencing count, and the 870-of-1500 count—are products of the assumed exposure distributions, not measurements; change the assumed distribution and the numbers change with it. They rest on two modeling conventions. In A, the anchors overlap in coverage—each agent roots in several of them (its identity issuer, a certificate authority, and the token issuer)—so the per-anchor blast radii sum to more than the population, and share of total risk is each anchor’s externality-weighted exposure R_i = b_i · e_i as a fraction of the summed Σ R_i. The OAuth issuer key alone reaches the whole fleet (so b_max/N = 1.0), yet it accounts for 80% rather than 100% of that weighted sum because the other overlapping anchors also carry exposure, with two of the six together reaching 90%. B instead assumes a moderately skewed, long-tailed distribution of anchor sizes rather than a uniform one—most per-namespace anchors small, a minority larger—so retiring 90% of its risk takes 870 of the 1500 anchors, far more than A’s two but well short of the roughly 1350 a uniform distribution would require.

The two outputs rank the work in opposite orders (Figure 3). In A, total effort is lower, yet a single unmigrated issuer key would let a CRQC forge any of 50,000 agents, two anchors carry 90% of that risk, and d = 0.7 means the operator likely does not control their timeline—so the first move is to pressure the IdP/CA and cross-sign those anchors immediately; the binding constraint is external control of a tiny critical set, not labor. In B, no single anchor is catastrophic; risk reduction means working through hundreds of anchors and a high-churn fleet, and the binding constraint is throughput and automation, which the operator largely owns.

Risk-quantification outputs and an order-independence result. The model’s risk-quantification indicators are explicit and distinct from the effort multiplier: the per-anchor forge-later exposure R_i = b_i · e_i (blast radius times externality) and the normalized worst-anchor blast radius b_max/N. These, not the effort total, drive the sequencing output. The central claim the structure supports is coefficient-independent and is stated as follows.

Proposition 1 (Order independence). For any positive coefficients, the migration-effort ranking and the forge-later-risk ranking over a fixed inventory are governed by different monotone functions of that inventory, so the two orderings need not coincide and, in concentrated-anchor topologies, invert. Argument. Effort aggregates across all factors and rises with the identity population through the credential term, whereas forge-later risk is governed by per-anchor exposure R_i = b_i · e_i, which is largest at the smallest, highest-fan-out anchors; one quantity increases in population and the other in concentration, so their maxima fall on different elements of the inventory whenever a small anchor underwrites a large sub-fleet.

What survives calibration. The robust, coefficient-independent claim is the ordering behavior, not the magnitudes: effort and forge-later risk are different functions of the same inventory. This holds for any positive coefficients; only the numbers move. The model therefore earns its keep by dissociating how much total work (the E* multiplier) from what to sequence first (sort anchors by b_i · e_i descending)—the credential-versus-anchor tension the Section 6 matrix encodes.

Calibration targets, in priority order: b_i first—which identities each anchor underwrites is directly measurable in discovery and is the inventory output most organizations lack; then α_c and α_a from per-identity and per-anchor migration labor across pilots; γ from observed schedule slippage on vendor-gated anchor migrations specifically—the coordination cost it stands in for, distinct from the labor the α terms capture; and the remainder (α_r, α_s, α_d, α_q) from a regression once two or three migration data points exist.

8.3. Cost and Complexity Drivers

Beyond the factor structure, five concrete drivers determine where the effort and overhead actually land. The first is inventory: an agentic estate must discover not only its identities but the anchors that underwrite them (Section 7.1), and the anchor-to-population mapping is the costliest item to produce because current tooling rarely captures it. The second is runtime performance: post-quantum primitives carry larger keys and signatures and higher verification cost (Section 2.2), and because agentic cryptography sits on the critical path of every action (Section 5.1), that overhead is paid per operation rather than amortized in a background job. The third is governance and attestation at machine scale—issuing, rotating, and attesting credentials for a high-churn population (Section 5.3) demands automation most identity programs do not yet have. The fourth is orchestration refactoring: signed execution graphs and the systems that verify them must be reworked for post-quantum signatures. The fifth is re-encryption of long-lived state (Section 5.5), a bulk cost that scales with data volume and is where deferral is most expensive. These drivers map back onto the model’s factors—inventory and governance to the credential and anchor terms, performance to the runtime factor, and re-encryption to the long-lived-data surface—and together they explain why the headline multiplier is dominated by different components in different topologies (Section 8.2).

Runtime performance, quantified. The performance envelope of the standardized primitives is now measurable from the published literature, and it bears out the runtime-versus-long-lived split this paper draws (Section 2.2). Hybrid key establishment adds a larger handshake on the wire (the X25519MLKEM768 client share is roughly 1.2 kB versus 32 bytes for X25519 alone), while operators deploying it at Internet scale report the principal trade-off as the larger handshake rather than added latency, with a major content-delivery network already protecting a substantial and growing share of its connections through hybrid post-quantum key agreement [34], using the IETF-defined X25519MLKEM768 named group [35]. On signatures, FIPS 204/ML-DSA produces signatures of roughly 2.4 to 4.6 kB depending on parameter set (about 3.3 kB for ML-DSA-65, roughly fifty times a P-256 ECDSA signature) with fast verification suited to runtime token validation, whereas FIPS 205/SLH-DSA produces signatures of roughly 7 to 49 kB with substantially slower signing and verification [2,3]. This is precisely why the roadmap assigns FIPS 204/ML-DSA to performance-sensitive runtime signing and FIPS 205/SLH-DSA to long-lived, low-frequency signatures such as model checkpoints and provenance (Section 7.2). The mitigations follow from the same envelope: hybrid handshakes during the transition, amortized and cached verification for repeatedly validated anchors, session resumption to avoid repeated full handshakes, and capacity planning where signatures exceed typical network MTUs. Full end-to-end benchmarking of these primitives across MCP, mTLS, and SPIFFE or SPIRE under representative agent workloads requires design choices the field has not yet settled (the inter-agent surface still lacks a standardized post-quantum target, Section 4.1 and Section 5.4) and is identified as future work (Section 12).

8.4. Timeline: A Compressed Window and Lengthened Work

Read as schedule rather than effort, the same structure pushes the two migratable terms of Mosca’s shelf-life condition [7]—migrate before an asset’s secrecy-or-trust lifetime plus its migration time exceeds the time remaining to a CRQC—in opposite, unfavorable directions.

A compressed window. Agentic AI shortens the time available. The harvest-now clock is already running on a population that is growing quickly, so the window is not merely finite but contracting as adoption adds exposure faster than remediation removes it. And the operator does not fully control the schedule: because the highest-blast-radius anchors are vendor- and IdP-owned (Section 5.2), the effective start of migration is gated by external roadmaps it can influence but not set. The time remaining before harvested material becomes forgeable or readable is therefore effectively shorter for agentic systems than a calendar date suggests, because the material whose trust must outlast T_q is being created continuously.

Lengthened work. At the same time, agentic AI lengthens the work. The amplification factors of Section 8.1, read as schedule, are sources of delay: runtime-negotiated cryptography must be migrated on live critical paths rather than in background jobs (Section 5.1); high churn means migrated primitives are exercised and re-attested continuously rather than once (Section 5.3); protocol diversity forces a protocol-by-protocol sequence gated by the least-agile link (Section 5.4); and the trust-anchor fan-out makes the first, most schedule-critical moves the ones that depend on third parties. The migration-time term is thus larger for agentic systems than for the conventional estate the federal deadlines were scoped to.

Two clocks, and a deadline that fits only one. The two movements compound: a contracting window and an expanding task mean the effective deadline for the agentic installed base is earlier, and its effective duration longer, than the 2030/2035 horizon implies for conventional systems. The more consequential point is structural. A fixed deadline is a stock instrument—it disciplines a finite estate toward a date—and it does not govern a flow, which agentic adoption makes the unmigrated population into (Section 10). For the installed base the deadline still applies but is tighter than it appears; for new deployments it is the wrong instrument entirely, because nothing about a 2035 date stops a classical-by-default agent shipped in 2034 from starting its own harvest-now clock. This also reframes cost as partly recurring: the effort E of Section 8.1 prices remediating the stock, but governing the inflow—keeping new agents off classical defaults—is an ongoing operating cost the static-N worked example does not capture. A timeline that counts only one-time remediation against a single date understates both the urgency for the installed base and the duration of the obligation for everything built after it.

9. Threat Model

9.1. Adversary Model and Assumptions

The assets this model protects map to the seven surfaces of Section 3 and the two exposure layers of Section 2.4: at the credential layer, the confidentiality of agent memory, embeddings, logs, and recorded transport sessions; at the anchor layer, and of higher consequence, the integrity of the asymmetric signing roots that underwrite the fleet—certificate-authority roots, the authorization server’s token-signing key, JWKS keys, model-registry signing roots, and workflow-signing keys. The distinction is deliberate: compromise of one credential affects one agent, whereas compromise of an anchor affects every identity beneath it.

Agentic deployments cross several trust boundaries, and the highest-value anchors sit on the far side of most of them. The operator controls its own credential store, memory, and sometimes a private CA or model registry; it does not control the public CA, the OAuth authorization server, the cloud key-management service, or the SaaS resource servers its agents call (Section 5.2). The model therefore assumes that several of the most consequential signing keys are held and operated by third parties whose migration timeline the operator cannot set—the externality the cost model carries as d and the cross term Δ (Section 8).

Adversary capabilities and the CRQC-timeline assumption. We model an adversary with three capabilities, the first two available today and the third deferred. (i) A network observer records TLS-protected agent and tool traffic in transit. (ii) A data-at-rest collector obtains stored ciphertext, logs, and embeddings, and—importantly—the public keys that issuers publish by design at JWKS and certificate endpoints. (iii) At an unknown future time T_q, the adversary gains a CRQC able to recover private keys from harvested RSA/ECDSA public keys and to break ephemeral Diffie–Hellman key agreement. We make no prediction about T_q. Following Mosca’s framing [7], the only assumption required is that material harvested today retains value until T_q—that an asset’s secrecy-or-trust lifetime plus its migration time can exceed the time remaining to a CRQC. The federal horizon (deprecation by 2030 and disallowance by 2035 for civilian non-NSS systems, per NIST IR 8547 [4]) is treated as a policy deadline, not a forecast of T_q.

The threat model centers on the quantum-capable adversary acting at and after T_q (Section 9.2). Agentic autonomy enters not as a co-equal second axis but as an amplifier of that threat: it lowers the cost and raises the value of the harvest and reconnaissance phase now, regardless of when or whether a CRQC arrives, an effect taken up where the two compound (Section 9.4).

9.2. Quantum Capability Against Agentic Cryptography

At and after T_q, the quantum-capable adversary acts along the two harvest axes. On the confidentiality axis (HNDL), recorded token-bearing transport sessions and exfiltrated memory, embeddings, logs, and training data become decryptable once the ephemeral Diffie–Hellman key agreement protecting them is broken; the damage is proportional to the secrecy lifetime of the harvested data (the memory-and-state and long-lived-data surfaces of Section 3). On the integrity axis (HNFL), the adversary recovers private signing keys from harvested public keys and forges agent identities, tool-authorization tokens, model-checkpoint signatures, workflow signatures, and provenance attestations. Anchor-layer keys are the highest-value targets by a wide margin: a forged credential is one identity, but a recovered issuer or CA key forges the whole fleet (the fan-out of Section 2.4). Runtime key-negotiation paths—hybrid FIPS 203/ML-KEM handshakes mid-migration—are a secondary target: a correctly constructed hybrid holds if either component holds, so the exploitable failures are downgrade to classical-only negotiation, mis-negotiation, and implementation or combiner-construction flaws, not the quantum break of the classical half of a sound hybrid.

9.3. Worked Scenario—Harvest-Now-Forge-Later Against a Shared Issuer

To make the dominant threat concrete, consider the highest-leverage path, traced in Figure 4: forging an entire agent fleet through its shared token issuer. The target is the centralized OAuth 2.1/OpenID Connect deployment of scenario A in Section 8.2, in which tens of thousands of agent identities root in a single authorization-server signing key. The scenario rests on two explicit assumptions, both standard in this deployment class: the issuer signs tokens with a Shor-vulnerable public-key signature algorithm (RSA, ECDSA, or EdDSA—any such scheme; the choice does not change the analysis), and resource servers accept tokens by validating the issuer signature against the published public key (JWKS or equivalent). Deployments that instead use symmetric HMAC-signed tokens or opaque introspection-validated tokens fall outside this scenario; their asymmetric exposure sits in transport and at the authorization server itself (Section 2.4). This quantum-enabled path, in which recovering one issuer key forges an entire fleet, is absent from the classical agentic-security literature on MCP and A2A, which treats tool poisoning and prompt injection rather than the cryptographic anchor (Section 4.1 and Section 5.4).

Phase 1—harvest (today, no privileged access). The authorization server publishes its public signing key at a JWKS endpoint by design, and issued JWTs travel over observable TLS sessions. The adversary collects the public key and a sample of issued tokens. None of this is an intrusion—the public key is meant to be public, the adversary can obtain token samples legitimately as an ordinary client of the same authorization server, and tokens may additionally surface in misconfigured or poorly governed telemetry and logging pipelines—so the activity is indistinguishable from normal client behavior and is exactly the reconnaissance an autonomous adversary performs at scale.

Phase 2—wait. The harvested public key is stored. Because it is an anchor rather than a credential, the operator’s routine defenses do nothing to it: short token lifetimes, credential rotation, and re-issuance all churn the credential layer while the issuer key—and the public value the adversary already holds—stays fixed for years.

Phase 3—forge (at T_q). With a CRQC, the adversary recovers the issuer’s private signing key from the harvested RSA, ECDSA, or EdDSA public key via Shor’s algorithm, and can then mint JWTs that are cryptographically valid for any subject in the fleet. Every resource server that validates tokens against that issuer accepts them as authentic.

Blast radius and why the obvious defenses fail. The forged-token capability spans the entire population the issuer underwrites—the 50,000 agents of the worked example, not one. Token rotation is irrelevant because the adversary now signs its own tokens; revoking individual agents is irrelevant because the adversary can mint new identities at will; and the operator cannot unilaterally fix the root cause, because in scenario A the authorization server is vendor-operated (d = 0.7) and its migration timeline is external. This is the concrete meaning of trust-anchor fan-out: a single unmigrated, externally owned signing key is a fleet-wide forge-later catastrophe, which is why the model’s sequencing output (Section 8.2) places cross-signing and rotating that issuer key first, ahead of the far larger credential-rotation effort. The mitigation is to migrate the anchor to a post-quantum signature (FIPS 204/ML-DSA or FIPS 205/SLH-DSA), or a hybrid, before T_q and—where the anchor is vendor-owned—to treat the vendor’s PQC roadmap as a procurement gate (Section 11).

9.4. Combined Risk and the Autonomy Amplifier

The quantum threat and the autonomy amplifier are most dangerous where they meet. Independent of any quantum capability, autonomous agents probe protocols, enumerate endpoints, and map which issuers underwrite which fleets at machine speed, which is the reconnaissance that builds the target list of high-value anchors to harvest; the 2026 CSA agent survey gives the empirical signal, with 79% of organizations reporting that agents create access pathways difficult to monitor and 68% unable to reliably distinguish agent from human activity [6], which both enlarges the harvestable surface and lowers the chance that harvesting is noticed. This is the connection to the Mythos-class adversary analysis [26]: an adversary that optimizes the harvest phase now maximizes the value of the forgery it can mount once a CRQC exists. The amplifier is present and addressable today through monitoring and least privilege, while the quantum forgery requires migrating anchors ahead of T_q, and the compounded case, autonomous harvesting of signed material for later forgery, is the scenario that most justifies acting before the threat is demonstrable.

10. Remediation and Prevention: Two Migration Populations

The framework, matrix, roadmap, and model developed so far describe a single task: remediating an installed base of agents that already depend on classical cryptography. But agentic adoption is rapid and ongoing, so the migration target is not a fixed stock—it is a flow. That distinction separates two populations with two different sets of implications, and conflating them understates the problem. Put sharply, agentic AI turns post-quantum migration from a finite inventory problem into a continuously regenerating identity, credential, and protocol migration problem.

The installed base—a stock to remediate. The agents in production today are a stock (the brownfield problem): a finite, if poorly inventoried, set of identities, anchors, and surfaces to discover, hybridize, and cut over. Everything in Section 6, Section 7, Section 8 and Section 9 addresses this population. Two features define it. First, the harvest-now clock has already started for it—its signed and encrypted material is already observable and storable, so its forge-later and decrypt-later exposure is accruing now. Second, its hardest constraint is dependency coupling, because many of its highest-blast-radius anchors are vendor-owned (Section 5.2). The instruments that fit a stock are remediation instruments: inventory mandates of the kind the federal government already imposes under OMB M-23-02 [36], prioritized migration deadlines (the 2030/2035 horizon), and the funding to execute them. The open question this surfaces is whether agents are actually inside those inventories—the failure mode is that they are omitted from the cryptographic inventory entirely.

New deployments—a flow to govern. Agents deployed from here on are a flow (the greenfield problem), and the flow itself splits in two. An agent built to be PQC-native or crypto-agile from inception never becomes migration debt and never starts a harvest-now clock at all; prevention eliminates the exposure rather than deferring it. An agent built to be classical—still the default, because the prevailing agent frameworks, SDKs, identity libraries, and protocols use classical cryptography out of the box—becomes new debt added to the stock the moment it ships. The instruments that fit a flow are prevention instruments, and they are different ones with different owners: procurement language requiring post-quantum readiness in new systems, and a shift in the defaults of the tooling itself—the Model Context Protocol authorization stack, agent platforms, identity providers, and model registries—toward hybrid and post-quantum modes. Concretely, prevention means PQC-capable or hybrid transport paths by default, short-lived and uniquely attributable agent identities, cryptographic bills of materials (CBOM/MBOM) that enumerate each agent’s cryptographic dependencies [24], and runtime controls that stop agents from minting unmanaged or classical-only credentials.

The two populations differ across every dimension that matters for planning (

Table 8. Two migration populations: Installed base versus new deployments.

Dimension	Installed Base—Brownfield	New Deployments—Greenfield
Migration type	Remediation of existing classical cryptography	Prevention/PQC-by-design
Dominant risk	Classical crypto already embedded; harvest-now clock already running	New agents expanding classical-crypto debt
Main task	Discover, inventory, prioritize, remediate	Design, procure, govern, enforce defaults
Typical dependency	Existing TLS, OAuth/OIDC, service accounts, certificates, KMS, SaaS connectors	New agent identities, toolchains, orchestration, plugins, model registries
Failure mode	Agents omitted from the PQC inventory	New agents deployed faster than PQC governance can absorb
Policy instrument	Add agents to crypto inventories; migration deadlines and funding	Require PQC-ready architectures before deployment; shift tooling defaults
Security implication	Preserves existing RSA/ECC exposure	Multiplies RSA/ECC exposure

):

Why the distinction matters: Debt can accrue faster than it retires. Because the two populations are governed by different instruments, an organization can be remediating the installed base and falling behind at the same time. Every quarter that agent tooling defaults to classical cryptography manufactures new migration debt, and if the inflow rate exceeds the remediation rate the unmigrated population grows even as remediation proceeds (Figure 5). A deadline disciplines the stock; nothing in the current posture disciplines the inflow. This reframes the central quantity of the model: the population is not the static N of the worked example (Section 8.2) but a time-varying N(t) with a debt-accrual inflow governed by the fraction of new agents still built classical—a fraction that prevention instruments, not remediation deadlines, control. The highest-leverage intervention is therefore also the cheapest and the one most absent from current guidance: stop creating new debt by changing the defaults, which is the prevention face of the crypto-agility argument of Section 5 and Section 7, not a separate idea. The agency-specific implications that follow (Section 11) divide along the same line—remediation instruments for the stock, prevention instruments for the flow.

11. Oversight and Policy Implications

11.1. GAO

GAO’s current PQC-migration reporting—GAO-25-108590 and GAO-23-106559 [10,11]—addresses federal coordination, workforce, and supply-chain readiness, but does not treat agentic and NHI-dense systems as a distinct class.

11.2. NIST

NIST PQC standards and migration guidance (including SP 1800-38 [12]) do not address agentic architectures or runtime-negotiated cryptography. The NCCoE agent-identity concept paper (February 2026) and its RFI [9,21] adapt existing IAM standards to agents but omit post-quantum cryptography entirely; the omission is explicit in those documents, not inferred here.

11.3. CISA

The CISA/NSA/NIST quantum-readiness guidance [18] and CISA’s product-categories list for PQC-capable acquisition [37] do not yet account for the NHI-plane expansion or the trust-anchor fan-out risk specific to agentic systems.

11.4. Federal Readiness Implications

Federal readiness for this class implies four concrete requirements. First, oversight should extend explicitly to the identity plane and its trust anchors, where forge-later risk concentrates (Section 2.4). Second, cryptographic-inventory mandates should require enumeration of NHIs and the signing roots that underwrite them, not only network endpoints, since that anchor-to-population mapping is what migration sequencing depends on and what current tooling least often produces (Section 7.1 and Section 8.2). Third, acquisition guidance should specify PQC-safe procurement language for AI systems, so that agents are not fielded on classical-by-default cryptography that immediately accrues new migration debt (Section 10). Fourth, model registries and provenance pipelines should carry explicit PQC-safe signing requirements, because model-integrity and provenance signatures must remain verifiable across deployment and retention lifetimes that can outlast a CRQC (Section 3 and Section 9). The attribution gap is already measured—most organizations cannot consistently distinguish agent from human action [6]—so audit and non-repudiation requirements must be cryptographically grounded rather than log-based. The federal transition timeline that agentic-systems readiness must meet—deprecation of quantum-vulnerable algorithms by 2030 and disallowance by 2035 for civilian non-NSS systems, per the Initial Public Draft of NIST IR 8547 [4]—presently assumes a human-paced, statically inventoried estate, not the runtime-negotiated, high-churn agent fleets analyzed here.

11.5. Skills and Tooling Gap

The instruments above presume capabilities—discovery tooling and a workforce that can execute—that do not yet exist for this class. The gap is a federal-readiness finding in its own right.

Tooling. Current cryptographic-discovery tooling enumerates endpoints and applications, not the NHIs and signing anchors the analysis requires; the anchor-to-population mapping that the model needs (the b_i input of Section 8.2) is precisely what existing tools rarely produce (Section 7.1). Federal guidance treats even conventional discovery as unfinished: CISA’s strategy for automated cryptography discovery and inventory acknowledges continuing uncertainty about whether current tools detect all cryptographic use, particularly embedded algorithms [38]. Operational telemetry is no better: in the 2026 CSA agent survey, 33% of organizations do not know how often agent credentials are rotated, 79% say agents create access pathways difficult to monitor, and 68% cannot reliably distinguish agent from human activity [6]—gaps that frustrate both inventory and post-migration verification. On the prevention side, the tooling that would stop new debt barely exists: prevailing agent frameworks and SDKs emit classical cryptography by default and expose few crypto-agility hooks (Section 10), and cryptographic bills of materials (CBOM/MBOM) for agents are nascent.

Skills. The workforce gap compounds the tooling gap. Agentic post-quantum migration sits at the intersection of three scarce specialties—post-quantum migration engineering, NHI and agentic-IAM governance, and crypto-agility architecture—and practitioners fluent in all three for an NHI-dense estate are rare. GAO already flags workforce readiness as a constraint for conventional PQC migration [10], and a systematic review finds migration practice still immature even for conventional software—limited PQC experience, high realization effort, and high complexity [20]; the agentic case is strictly harder because it is runtime-negotiated, dependency-coupled, and operates at machine scale. Fragmented ownership makes this worse: in the same survey, responsibility for agent identity is split across security (28%), development (21%), and IT (19%), with dedicated identity teams owning it only 9% of the time [6], so the expertise the problem demands is distributed across groups that do not yet coordinate on it. Closing this gap is a precondition for the inventory mandates and deadlines of Section 10 and Section 11.4 to function, and it is itself an open question (Section 12).

11.6. New Directives, or Clarified Scope?

The natural policy reflex is to call for new directives. The more defensible position is that the gap is scope and specificity, not authority: the existing instruments already reach agentic systems if read correctly, and what is missing is mostly clarification—with one genuine exception on the prevention side.

Existing authority already reaches agents. The core instruments are in place. OMB M-23-02 requires agencies to inventory systems that use quantum-vulnerable cryptography and to prioritize their migration [36]; the federal transition horizon sets the deadline (Section 11.4, per NIST IR 8547 [4]); and FIPS 203/204/205 [1,2,3] are the targets. An agent that authenticates over TLS and presents an issuer-signed token is, on a plain reading, a system using quantum-vulnerable public-key cryptography—already in scope. The problem is not that agents fall outside the mandate; it is that the mandate’s operational definitions were written for a human-paced, application-centric estate and do not direct an agency to look for them.

Clarifications, not new authority. Three clarifications would close most of the gap without new statutory authority. First, extend the inventory definition under M-23-02 to enumerate NHIs and their trust anchors—issuer and CA signing keys, JWKS keys, model-registry signing roots—not just endpoints and applications, so that the anchor-to-population mapping the analysis depends on (Section 7.1 and Section 8.2) is actually collected. Second, name AI models explicitly as inventory items: model artifacts carry signatures and their registries are signing anchors (the model-integrity surface of Section 3), so model-signing provenance belongs in the cryptographic inventory alongside the agents that load them; emerging PQC-aware provenance and attestation schemes for model artifacts indicate how this can be operationalized [39]. Third, add post-quantum readiness to the procurement language for AI and agent systems, so that acquisition reaches the vendor-owned anchors an operator cannot otherwise compel (Section 5.2).

The one genuinely new instrument: The flow. Every clarification above governs the installed base—it disciplines a stock toward a deadline. None disciplines the inflow of new classical-by-default deployments (Section 10), and that is a true absence rather than an unscoped existing rule: nothing currently requires that new agent systems be crypto-agile or PQC-ready before they ship. A forward-looking directive—a default-PQC or crypto-agility requirement attached to new agent deployments and the platforms that emit them—is the one addition that targets the flow rather than the stock, and it is the highest-leverage and least-addressed of the policy moves this paper identifies. In short: clarify scope for the installed base, and add one prevention instrument for the flow.

12. Open Research Questions

Several questions remain open and together define a research agenda for this class:

• PQC-safe agent-identity standards and attestation at machine scale, building on emerging agentic-IAM guidance for unique, short-lived, cryptographically bound agent identities [22].
• PQC-safe tool-use authorization (a PQC-aware successor to OAuth-rooted token issuance).
• PQC-safe multi-agent negotiation (the inter-agent gap left open by current MCP/A2A maturity).
• PQC-safe model-signing pipelines (FIPS 204/ML-DSA or FIPS 205/SLH-DSA in registries).
• PQC-safe memory and state architectures.
• Measurement: Estimating the PQC-relevant cryptographic-NHI population and the trust-anchor count/reuse distribution—quantities no current source reports.
• Empirical benchmarking: End-to-end handshake latency, signature and verification throughput, and storage overhead for hybrid FIPS 203/ML-KEM, FIPS 204/ML-DSA, and FIPS 205/SLH-DSA across MCP, mTLS, and SPIFFE or SPIRE under representative agent workloads, together with a reference post-quantum-terminating sidecar transformation and a hybrid-negotiation profile built on the existing TLS 1.3 hybrid key exchange.

13. Limitations

This paper is a conceptual framework, and its limitations follow from that choice and from the state of the evidence it draws on.

Conceptual, not empirical. The framework, matrix, and model are analytical instruments, not validated artifacts. The paper offers no implementation, no measurement of a real migration, and no case study; its claims concern how to structure the problem and sequence the work, not observed outcomes. It should be judged on whether it organizes the problem more usefully than the alternatives, not on predictive accuracy, which it does not claim.

The model is uncalibrated. The coefficients in Section 8 are illustrative placeholders, and the worked example demonstrates the model’s behavior rather than real magnitudes. The robust, coefficient-independent claim is the ordering—that migration effort and forge-later risk rank the work in opposite orders, and that in concentrated topologies a few anchors dominate risk—not any multiplier value. Calibration requires per-identity and per-anchor migration-labor data from real pilots, which does not yet exist (Section 8.2); until it does, the model is a structure for reasoning, not a costing tool. Three further limitations bound the model. The baseline is a civilian-estate figure used to anchor an agentic-estate multiplier, a deliberate category approximation (Section 8.1). The sequencing guarantee rests on the coefficient-independent ordering of Proposition 1 rather than on validated coefficients, so it asserts the direction of the ranking, not the size of any gap. And the worked-example exposure figures depend on assumed anchor-size and fan-out distributions that a given real inventory may not match.

Reliance on heterogeneous, industry-sourced data. The scale premise rests on vendor telemetry and an industry-sponsored survey (Section 2.4), which are not peer-reviewed, use inconsistent definitions and methodologies, and are not scoped to cryptographic reliance. The paper treats these as a caveated spread rather than measurements, but a firmer empirical basis for the NHI population and its anchor distribution remains an open need (Section 12).

A moving target. The agentic ecosystem and the post-quantum standards are both evolving. Protocol specifics (the Model Context Protocol authorization revision, the maturity of agent-to-agent protocols) and standards status (NIST IR 8547 as an Initial Public Draft, FIPS 206/FN-DSA forthcoming) are stated as of writing and may date quickly; the inter-agent surface in particular has no stable standard to migrate to, so claims about it are necessarily provisional.

Timeline assumptions. The urgency case rests on the harvest-now premise and is deliberately agnostic about when—or whether—a CRQC arrives (Section 9.1). For assets whose secrecy or trust lifetime is short, the decrypt-later and forge-later risks are correspondingly smaller; the paper assumes the conservative case, in which long-lived signatures and retained data outlast the migration window.

Scope and decomposition. The analysis adopts the civilian non-NSS framing throughout; national-security systems and their CNSA 2.0 scope are out of scope. The seven-surface taxonomy and the credential/anchor split are proposed organizing schemes, not claimed to be exhaustive or uniquely correct; other decompositions are possible, and the paper argues only that this one is discriminating and useful. Symmetric and hash-based (Grover-class) exposure is acknowledged but treated as secondary, consistent with the focus on the asymmetric migration driver.

14. Conclusions

Agentic AI shifts PQC migration from a cryptographic upgrade to a systems-of-systems modernization, driven by runtime-negotiated cryptography, NHI density, and dependency coupling, and exposed along both HNDL and HNFL axes. Crucially, the migration burden is layered: a large, cheap-to-re-credential identity fleet sits atop a small set of asymmetric trust anchors whose forge-later blast radius equals the fleet itself. The field lacks frameworks, discriminating metrics, and oversight tailored to this class; this paper offers, to our knowledge, the first treatment of each.