MFA (Multi-Factor Authentication)
Multi-factor authentication (MFA) requires users to present two or more verification factors to gain access to a resource. Factors typically combine something the user knows (password), something they have (phone, hardware key), and something they are (biometric). MFA significantly reduces the risk of unauthorized access from compromised credentials.
Why It Matters
MFA is one of the most effective security controls available. Microsoft estimates that MFA blocks over 99.9% of account compromise attacks. It is a baseline requirement in most compliance frameworks (SOC 2, ISO 27001, PCI DSS).
For AI agents, MFA presents a design challenge. Agents cannot complete an MFA challenge the way humans do (they cannot tap a phone notification or scan a fingerprint). Agent authentication typically uses API keys, OAuth tokens, or certificate-based credentials instead of interactive MFA flows.
This is why credential mediation matters: if agents cannot complete MFA themselves, the credentials they use must be managed, scoped, and rotated by a governance layer that was authenticated through MFA by the human who delegated authority.