Agentic CLM

Certificate Lifecycle Management

AI-native certificate lifecycle management — discovers, renews, verifies, and audits every TLS certificate across Kubernetes, Key Vault, and hybrid estates.

70%

Less renewal toil

89%

Fewer cert outages

< 2 min

Execution time

100%

Audit coverage

Quantifiable returns.

Certificate expiry causes real outages. Manual renewal consumes engineering hours. Compliance evidence is assembled by hand. Agentic CLM eliminates all three.

70% less renewal labor

Manual renewal averages 2–4 hrs per certificate. Automated paths complete in under 2 minutes. At 100 certificates per year that's 40+ engineering hours recovered monthly.

89% fewer cert outages

Predictive detection 30 days ahead with automatic renewal removes the root cause. Each prevented outage avoids $300K–$5M in downtime costs. †

100% audit coverage

Every policy decision, approval, CA request, deployment, and verification produces an immutable evidence record. Compliance preparation drops from weeks to near-zero.

80%+ zero-touch rate

Non-production and low-risk certificates renew without human involvement via a Standard Change. Production paths route through ServiceNow Normal Change with CAB approval.

8× faster than manual

Industry manual average: 4–6 hours per renewal. Agentic CLM execution: under 2 minutes. Even approval-gated renewals complete within hours rather than days.

$300K–$450K annual savings

Illustrative model for a 1,000-certificate estate. Labor savings plus outage avoidance. Preventing one P1 outage covers platform cost for the year. †

† Downtime cost estimates based on Gartner IT infrastructure research (~$5,600/min average unplanned downtime cost). Labor figures from industry PKI lifecycle surveys (Venafi, DigiCert). All figures are illustrative for a 1,000-certificate enterprise estate.

One platform. Complete control.

Eight specialised AI agents collaborate inside a single Durable Functions orchestration. Every capability is policy-enforced and fully auditable.

8 AI Agents

Discovery & Inventory

Continuous scanning across all sources. AI infers ownership from metadata gaps.

Risk Prediction

Urgency scoring, blocker detection, and optimal renewal timing with confidence gates.

Policy Approval

Deterministic OPA evaluation — routes to auto-renew, approval gate, or blocked.

Planning

Reads renewal memory and knowledge-base runbooks before drafting every CHG.

ServiceNow Change

AI-drafted change records with steps, rollback, and business risk. Standard or Normal CHG.

Renewal Execution

CA request, Key Vault custody, Kubernetes rotation, verification — all in one durable workflow.

Verification & Audit

Live TLS socket probe, auto-recovery on failure, AI anomaly summary, immutable evidence.

SRE Polling

Monitors ServiceNow every 5 minutes. Resumes the workflow automatically on approval.

4 Discovery Sources

AKS TLS Secrets

Namespace, ingress, and secret discovery across all AKS clusters.

cert-manager

Certificate, Issuer, and ClusterIssuer resources mapped to bound secrets.

Azure Key Vault

Certificate metadata inventory without exposing private key material.

VM HTTPS Endpoints

TLS socket probes for nginx, IIS, Apache, and any HTTPS-serving process.

4 Cosmos DB Containers

Container	Purpose
workflow-history	Immutable activity records and rolling orchestration state per workflow
certificate-inventory	One document per certificate — expiry, risk, owner, namespace, source
lifecycle-events	One document per lifecycle activity with stage, status, and ServiceNow ticket ID
certificate-memory	Renewal history, prior CA used, fingerprints, and planning summaries per certificate

Seven stages. Fully orchestrated.

Every renewal — auto-approved or approval-gated — follows the same durable sequence. The policy decision at stage 3 determines the ServiceNow change type; remaining stages are identical.

Discover

Heartbeat scans AKS, cert-manager, Key Vault, and VM endpoints every 5 minutes. AI enriches with ownership inference and shadow certificate classification.

Predict risk

Risk Prediction Agent scores expiry urgency, predicts blockers, and recommends timing. Low-confidence output blocks the workflow — never silently skipped.

Evaluate policy

OPA bundle evaluates environment, expiry window, and owner presence.
Auto-approved Standard CHG created for traceability — workflow proceeds immediately.
Approval required Normal CHG created — workflow parks until ServiceNow reaches Implement state.

Plan & draft CHG

Planning Agent reads certificate memory and fetches the matching runbook via vector search. AI drafts the CHG with implementation steps, rollback, owner contact, and business risk.

Execute renewal

CA issues new certificate. Key Vault stores custody record. Kubernetes TLS secret is created or rotated atomically. Snapshot taken before any mutation for rollback.

Verify

Live TLS socket probe checks issuer, SANs, chain, and expiry on the live endpoint. On failure: automatic snapshot restore, re-verification, and audit write regardless of outcome.

Audit

Every action is written to Azure Blob and Cosmos DB as an immutable evidence record. AI summarises anomalies. Grafana dashboard updates within 5 minutes.

AI-first. Safety-bound.

AI output is a required workflow artifact at defined boundaries. Deterministic controls enforce every safety-critical decision — AI can recommend but cannot approve, mutate, or override governance.

What AI does

Risk enrichment

Urgency prediction, blocker identification, timing recommendation — with a confidence score that gates every output.

Policy explanation

Plain-language explanation of every routing decision for operators and auditors.

Renewal plan drafting

Knowledge-base-grounded CHG narrative with steps, rollback, owner contact, and business risk.

Owner inference

Infers ownership from namespace and labels when Kubernetes annotations are missing.

Verification summary

Summarises TLS probe outcome and any chain or SAN anomalies in plain language.

Audit summary

AI-written lifecycle narrative stored as part of the immutable audit evidence record.

OPA Policy — 3 Configurable Profiles

Profile	Renewal window	Emergency window	Owner required	Use for
standard	30 days	7 days	Yes	Default — all environments
conservative_production	45 days	14 days	Yes	Regulated or high-risk production
aggressive_automation	21 days	3 days	No	Dev / lab only

Policy rules live in policy/*.rego — editable by security teams without code deployment. Switching profiles requires one app-setting change.

Knowledge Base

Application runbooks

Markdown runbooks per application in knowledge-base/runbooks/. Planning Agent fetches the best match via Azure AI Foundry vector search before drafting every CHG. Updated via GitHub Action on push.

Owner registry

YAML namespace-to-team mapping in knowledge-base/owners/team-owners.yaml. Queried for owner contact when Kubernetes annotations are absent.

Secure by design.

No credentials stored in the application. Every action is identity-bound, policy-gated, and permanently recorded.

Managed identity

Azure Functions uses a managed identity for all service calls — Key Vault, AKS, Cosmos DB, AI Foundry, and storage. No stored secrets or API keys.

Entra ID SSO

Application access via PKCE-secured OAuth2 through Kyndryl Entra ID. No passwords stored by the application.

Key Vault custody

Certificate material stored directly in Key Vault. Private keys never appear in workflow history, logs, or audit records.

OPA policy enforcement

All renewal, approval, and mutation decisions pass through the OPA bundle. Rules are source-controlled and security-team-editable.

ServiceNow approval gate

Production certificates require a Normal Change before any mutation. The orchestration parks and only resumes after the CHG reaches Implement state.

Immutable evidence

Every activity writes an immutable record to Azure Blob and Cosmos DB. Always audit-ready — no reconstruction needed.

RBAC throughout

AKS: Azure RBAC + Entra ID. Cosmos DB: native SQL RBAC. Key Vault: RBAC roles on runtime identity. No shared-access keys.

AI safety guardrails

Low-confidence or missing AI output blocks the workflow. AI cannot approve changes, mutate secrets, or override policy outcomes.

Namespace governance

CLM creates TLS secrets but not Kubernetes namespaces. Namespaces carry RBAC and network policies — platform teams provision them (ADR-0029).

Pluggable by design.

Every external system is abstracted behind an adapter. Swapping a CA or adding a discovery target requires a single new adapter class — no orchestration changes.

Compute & Orchestration

Azure Functions

Python 3.11 serverless runtime. 20 activities deployed as a single package.

Durable Functions

Long-running orchestration with replay, external events, and compensating recovery.

Azure Storage Queues

Approval-checks queue for automatic ServiceNow polling. Renewal and verification dispatch queues.

Cosmos DB

4 NoSQL containers — workflow history, cert inventory, lifecycle events, certificate memory.

AI & Intelligence

Azure AI Foundry

gpt-4o-mini for risk, policy, planning, and audit agents. Managed identity auth.

Vector Store

AI Foundry file search for runbook retrieval. Updated automatically on Git push.

OPA Policy Bundle

3 configurable profiles. Rego rules editable without code deployment.

Certificate Memory

Per-certificate renewal history in Cosmos DB. Read by Planning Agent before every CHG.

Security & Platform Targets

Azure Key Vault

Certificate custody. RBAC-secured. Private keys never leave approved boundaries.

Microsoft Entra ID

Managed identity for all service calls. PKCE OAuth2 for user SSO.

AKS / Kubernetes

TLS secret creation and rotation. AAD + Azure RBAC. Namespace governance enforced.

cert-manager

Discovery of Certificate and Issuer resources. Phase 2: full lifecycle management.

ITSM & Certificate Authority

ServiceNow

Standard CHG (auto-approve traceability) + Normal CHG (approval-gated). Automatic Implement-state detection via Storage Queue polling every 60 seconds.

step-ca

Phase 1 CA. Swap for DigiCert, Venafi, or ADCS via adapter pattern — zero orchestration changes required.

Azure Blob Storage

Immutable audit evidence records per workflow activity. Retention-policy controlled.

Azure Log Analytics

All structured telemetry events. Source for Grafana and Monitor Workbook queries.

Observability

Azure Managed Grafana

37-panel enterprise dashboard. AI reasoning feed, workflow pipeline, policy decisions, audit events, drill-through from any KPI.

Azure Monitor Workbook

Discovery and lifecycle views populated by live and seeded telemetry.

Application Insights

All structured clm.* telemetry events queryable via KQL.

Scheduled Alerts

Alerts on expired certs, discovery failures, evidence gaps, and low-confidence AI output.

Agentic CLM

Agentic Certificate Lifecycle Management