Kerberos is used as an authentication protocol, but it's fundamentally a key agreement/exchange protocol.
When a user gets a ticket from Active Directory for an application server a session key is generated and stuffed into the request. The application server decrypts the ticket and now has a session key. The server may decide it doesn't trust that key and in a final act tells the client to use a new provided key.
Once the client and server agree on a key they can communicate privately.
There are multiple catches to this though. The Kerberos spec sort of dictates how you send data back and forth, but it's mostly left to the developer to figure it out. Windows has an implementation, but you don't get to control the parameters like you do with TLS. This means developers tend to just take the key, derive it into something else, and shove it into a seperate protocol.
That said, you probably don't want to use Kerberos for secure communications. You have to build a lot of boilerplating into your code to get it working safely, whereas TLS already handles most of this for you.