Zero Trust for AI Agents

Zero trust for AI agents applies the never-trust-always-verify principle to autonomous software: no agent action executes on identity alone. Every request is verified against the agent's mandate across six dimensions, who, what, when, where, why, and how, at a boundary the agent cannot route around, and every verdict is recorded tamper-evidently.

From sessions to actions

Classic zero trust, codified in NIST SP 800-207, dismantled the castle-and-moat: no user or device is trusted for being inside the network, every session is verified. It was designed for subjects that authenticate, then behave roughly as predictably as their role suggests.

Agents break that assumption in one specific way: authentication says nothing about the next action. An agent that legitimately holds credentials can, one request later, call a tool it never called before, against an endpoint nobody scoped, for reasons encoded in a prompt nobody reviewed. The unit of trust has to shrink, from the session to the individual action.

That shift has an architectural consequence. Per-action verification cannot live inside the agent, because a capable agent can be prompted or compromised into bypassing its own rules. It has to happen at a boundary in the data path, where the verdict is deterministic: the action matches the mandate and executes, or it does not and is blocked before the upstream ever sees it.

The six dimensions of per-action verification

WHO

Which cryptographically identified agent is acting?

unverifiedShared service accounts: ten agents, one API key, zero attribution.

WHAT

Is this specific action inside the agent's mandate?

unverifiedAn expense agent that can also read the HR database.

WHEN

Is the action happening at a plausible time and rate?

unverifiedA wire transfer to a new payee at 2 AM, at machine speed.

WHERE

Is the target endpoint on this agent's allowlist?

unverifiedData exfiltrated to an endpoint nobody scoped.

WHY

What retrieval and reasoning context led to this action?

unverifiedA decision nobody can reconstruct for Article 14 oversight.

HOW

Which tools and methods is the agent invoking?

unverifiedAn MCP tool call that bypasses every application control.

Together the six answers form the fingerprint of an action. Verified, they justify execution; recorded, they make the action reconstructable; hash-chained, they make the record evidence. Any single unverified dimension is grounds to block: deny by default.

Where existing frameworks stand

The framework landscape agrees on the principles and stops short of the enforcement question. Use these to decide what your governance requires; none of them is the runtime that enforces it.

NIST SP 800-207	The zero trust architecture standard. Defines the principles for users and devices; agents inherit them but are not its subject.
OWASP Agentic Security	Community threat taxonomy for agentic AI, including goal hijacking and tool misuse. Describes attacks, not enforcement architecture.
AWS agent scoping guidance	Cloud-vendor guidance for scoping agent autonomy in tiers. Useful vocabulary, scoped to one vendor's stack.
Anthropic agent guidance	Model-vendor guidance on safe agent design. Strong on model behavior, silent on independent evidence.
SANS guidance	Practitioner training material on securing agentic systems for security teams.
Agentic Trust Framework	A vendor-authored open spec, published via the CSA blog. Five governance questions and a maturity ladder.

What enforcement looks like in practice

The Kyde Gateway implements the boundary as a governance proxy: agents reach their model providers only through it, configured with one environment variable, no agent code changes. Every request is checked against the agent's mandate deterministically; out-of-scope requests receive a 403 before the upstream sees them. Every verdict, allowed or blocked, lands in a hash-chained ledger, with Ed25519 signing on the Enterprise edition.

Start in observe mode: full recording, no blocking, deployed in minutes. Write enforcement policy against what you actually observe. Promote agents to more autonomy when the record supports it.

Start your audit → See the Platform →

FAQ

Is zero trust for AI agents different from normal zero trust?

The principle is identical: never trust, always verify, deny by default. The subject changes. Classic zero trust verifies who connects (user, device) at session start. Agents require verifying every action, because a legitimately authenticated agent can still act far outside its mandate one request later. Identity checks once per session become six-dimension checks once per action.

Can I implement zero trust for agents inside the agent framework?

Not credibly. Zero trust assumes the subject being verified cannot influence the verifier. Guardrails inside the agent share the agent's runtime, its permissions, and its compromises. Enforcement has to sit at a boundary the agent cannot route around, which in practice means the network path to the model providers.

What is the minimum viable starting point?

Observation. Route agent traffic through a governance gateway in observe mode: no blocking, no behavior change, full recording. Within a week you know who acts, what leaves your network, and what it costs. Enforcement policies come second, written against observed reality instead of guesses. The Kyde gateway does exactly this.

Which regulations effectively demand this?

None uses the phrase zero trust for agents, but the obligations converge on it: EU AI Act Articles 12 and 14 require tamper-evident logging and effective human oversight (high-risk enforcement begins December 2, 2027), NIS-2 makes management personally liable for security controls, and DORA requires provider-independent records for financial entities today.