AI agents are reshaping enterprise computing’s security model. Traditional applications execute predefined logic. Human users make decisions, and applications enforce them. AI agents introduce a third category: non-human software principals that can interpret context, make decisions, invoke tools, access data, and orchestrate multi-step workflows with minimal human intervention. Authentication and network controls do not necessarily establish that the agent should perform the specific action it is attempting at this moment. This article examines Zero Trust for AI agents and explains why traditional perimeter controls weren’t designed for this architecture.
NIST’s 20251 implementation guidance (NIST SP 1800-35) defines Zero Trust Architecture (ZTA) as an architecture in which access to enterprise resources is continuously evaluated rather than implicitly trusted based on network location. Zero Trust for AI agents means treating every agent, agent instance, delegation relationship, tool invocation, and consequential action as an explicit security decision, rather than assuming trust based on network position, prior authentication, or the legitimacy of the underlying application.
The core principle of Zero Trust remains the same: never implicitly trust, continuously verify, and enforce least privilege. What changes is the security subject. Zero Trust for AI agents must now govern autonomous and semi-autonomous software actors operating at machine speed. For AI agents, that principle must extend beyond connectivity and identity to include intent, task scope, tool use, delegation, and execution. This creates a more granular trust model, as depicted below:
An agent should therefore have a distinct identity and an accountable owner, but identity alone is insufficient. Consider an AI procurement agent that is legitimately authorized to read approved supplier records, retrieve contracts, compare pricing and generate purchase recommendations. From a security perspective, that same agent should not automatically have permission to modify supplier banking information, execute payments, create administrative accounts or export the organization’s entire supplier database. The security question is no longer simply whether this agent is authorized, but whether it is authorized to perform this specific action, against this resource, for this task, under this context at this point.
Traditional perimeter security assumes a critical security boundary between trusted internal infrastructure and untrusted external networks. That assumption is increasingly irrelevant to agentic systems. An enterprise AI agent may legitimately run inside the corporate cloud, Kubernetes cluster, SaaS platform or on an employee’s trusted endpoint.
The AI agent is already in an enterprise environment when it begins interacting with internal systems. An attacker does not necessarily need to breach the network perimeter; instead, they may simply manipulate an agent that already has legitimate access. This can be illustrated as follows:
Every network control in that chain may function correctly:
Yet the transaction may still be malicious because the agent’s decision-making process was manipulated. This is one of the most significant AI agent security risks, and its implication for security architecture is clear: network trust cannot be used as a proxy for agent trust.
Zero Trust already requires continuous verification of human users, devices, applications, and resources. AI agents introduce additional dimensions:
| Dimension | Human User | AI Agent |
| Identity | Person | Non-human principal |
| Authentication | Password/passkey/MFA | Workload/agent credentials |
| Device context | Usually available | Often absent or ephemeral |
| Intent | Human decision | Model-mediated decision |
| Execution speed | Human-scale | Machine-scale |
| Privilege | Usually role-based | Often dynamically delegated |
| Task duration | Session-based | Potentially long-running |
| Delegation | Human-to-application | Agent-to-tool/agent |
| Behavior | Relatively constrained | Adaptive and non-deterministic |
| Accountability | Direct human actor | Agent, owner and initiating principal |
Enterprise Zero Trust AI architectures therefore need at least three identity relationships:
These distinctions become essential when investigating an incident because they place subsequent activities in proper context.
Giving every agent a unique identity is an important starting point, but it doesn’t solve the whole problem. A compromised agent can still possess a perfectly valid identity. This creates a confused deputy problem: an attacker can exploit the agent’s legitimacy to perform unauthorized actions. Therefore, the missing control is action-level authorization, which evaluates not just who the agent is, but whether a specific action is permitted in a particular context.
Consider how an agent’s identity, a valid OAuth or workload token, and an approved API can make access to sensitive resources technically legitimate. A stronger architecture adds that control:
The policy engine can evaluate attributes such as agent identity, the initiating user, the requested action, behavioral history, and the delegation chain. This shifts Zero Trust from ‘authenticate the caller’ to ‘authorize the operation.’
The security problem becomes even more complex in multi-agent architectures. Consider a workflow in which a human initiates an action through an orchestrator agent, which delegates tasks to a research agent and a data agent before accessing the database tool. The human may have authorized the original workflow, but that does not mean every downstream agent should inherit the human’s full privileges. Delegated authority should be explicit, scoped, and independently enforceable at every step of the agent chain. This is where AI agent orchestration security becomes critical. Every delegation should establish:
Without these controls, privilege can propagate across an agent graph, creating unintended paths to sensitive resources.
Traditional microsegmentation remains highly relevant, but its role has shifted. Traditionally, it asks which workloads can communicate with which. Agentic environments require additional questions:
This creates identity-aware microsegmentation. For example:
The segmentation boundary should therefore exist at multiple layers, from the network and workload to identity, APIs, data, tools, and ultimately the actions performed.
Elevation should be task-scoped, time-bound, and policy-controlled. Standing privilege is especially dangerous for autonomous agents because an attacker who compromises the agent inherits its persistent authority. A stronger pattern is:
Credentials should ideally be short-lived, narrowly scoped, bound to the agent or workload, and limited to specific resources. They should also be auditable and automatically revoked or expire. The principle is simple: enterprises should not grant an agent permanent authority to perform an action it needs only occasionally.
This is an important operational consideration. Blocking an agent during execution can create an inconsistent state. Consider an agent that creates a purchase order, reserves inventory, attempts payment, and is then classified as high risk before completing the workflow. Simply terminating the process may leave partial transactions. Agent security therefore requires transaction-aware enforcement. High-risk workflows should support checkpoints, transaction rollback, human approval gates, and safe termination.
For agentic systems, Zero Trust should not be limited to allow or deny. Policy engines need to support allow, allow with restrictions, and require approval. They should also be able to suspend, revoke, or terminate transactions, which is essential for operating long-running autonomous agents.
AI agents can now interpret untrusted information and dynamically determine their next actions, which makesmaking traditional perimeter security insufficient. The security boundary has movshifted from the network and application to identity, task, policy, tool, resource, and action. That shift is the essence of Zero Trust for AI agents. For CISOs and security architects, the future of Zero Trust is not merely about controlling who can access the network. It is about controlling what autonomous software is allowed to do, one action at a time. That is the security model required for an enterprise in which AI agents become operational actors rather than passive software features. Explore AI Agent Authorization at the Endpoint: Why Least Privilege Breaks Down for Non-Human Identities to further understand why agent identity must be complemented by granular, action-level authorization.
For effective verification, use a dedicated, cryptographically verifiable non-human identity rather than shared API keys or generic service accounts. Where practical, bind all credentials to the AI agent instance, workload, or execution context. Authorization should also evaluate the initiating principal, task, requested action, resource, delegation chain, and current risk, rather than trusting identity alone.
NIST SP 800-207 states that access decisions should be based on explicit authentication and authorization, not on implicit trust based on network location or asset ownership. For AI agents, this means extending Zero Trust principles to non-human identities, individual tool calls, delegated permissions, and resource-level actions. Applying continuous evaluation and least-privilege access to agent workflows ensures that authorization is reassessed as the task, context, or risk changes.
Yes. Organizations can build on their existing identity, access management, policy enforcement, monitoring, and risk assessment capabilities. The key is extending these controls to AI-specific risks, including agent delegation, tool execution, dynamic permissions, and autonomous actions. Start by inventorying AI agents and their tools, then define permitted actions and enforce least privilege, and log agent activity before expanding to more complex workflows.
Microsegmentation establishes enforcement boundaries that limit where AI agents can communicate and the infrastructure they can reach. Zero Trust adds identity, context, authorization, and continuous verification to this process. Together, the two concepts create identity-aware segmentation, in which an agent’s network location does not determine whether it can access a resource or execute an operation.
References
