Adapting Zero Trust Architecture to AI Agents: Frameworks, Controls, and Challenges

Key takeaways:

• Zero trust approach has been a gold standard for network and data security for years, but it must be changed to protect data and resources from misconfigured and abused AI agents.
• To secure AI agents, development teams have to make zero trust controls more nuanced. They should take into account agent’s intent, agency, and always assume compromise.
• While there’s no universal detailed guidance on zero trust architecture adjusted to AI agents, several authorities offer controls and principles dev teams can follow.
• The key challenge of building AI agentic systems compliant with zero trust lies in designing a secure system that fits agents and risks of a particular organization, as well as updating it when agents evolve.

Giving an AI agent access to corporate systems means trusting it to make decisions that developers can’t fully predict. Traditional zero trust reduces this risk, but applying it to autonomous, non-deterministic systems requires new architecture and controls.

In this article, we explore:

• Changes in zero trust principles that AI agents require.
• Available frameworks and approaches for implementing zero trust for AI agents.
• Practical ways to control agent identities, permissions, behavior, and autonomy.

This overview will help technical decision-makers and engineering teams design secure agent integrations or strengthen existing deployments.

Why traditional zero trust doesn’t work for AI agents

Zero trust approach, as defined and described in NIST SP 800-207, assumes that actors can be secured with continuous trust evaluation per session or per request based on the requester’s identity, the state of the device making the request, and behavioral and environmental attributes.

Those trust evaluation engines become unreliable when applied to AI agents.

Agentic AI is non-deterministic; it doesn’t follow a pre-designed workflow and doesn’t request access to the same resources for the same purposes. It can make independent decisions, request access to perform undiscussed activities, or delegate tasks to other services and agents in a corporate system.

Because of that, enforcing traditional zero trust architecture (ZTA) on AI agents creates a security gap where an agent receives a permission for an activity and runs with it, which may create the following risks:

How zero trust must change to secure AI agents

Companies implement traditional zero trust in different ways but those implementations are based on three core principles:

• Never trust, always verify.
• Enforce the least privilege principle everywhere.
• Assume the possibility of a breach at every step.

You don’t need to reinvent these principles completely to enforce them on AI agents. But each principle has to be adjusted the following way:

Traditional zero trust implementation is usually guided by NIST SP 800-207 that describes each architecture component in detail. In 2026, zero trust architecture for AI agents isn’t described in such detail yet and companies have to design their own implementations.

Emerging zero trust approaches for AI agents

Currently, you can use the following guidelines to build zero trust security for AI agents:

• Anthropic Zero Trust for AI Agents. This comprehensive framework offers a maturity-based model for phased implementation of zero trust. Its examples and some of the practices lean on Claude capabilities.
• Agentic Trust Framework (ATF), published through the Cloud Security Alliance. ATF extends zero-trust concepts to agent governance and describes autonomy levels that help organizations match controls to an agent’s authority and risk.
• Coalition for Secure AI (CoSAI) Principles for Secure-by-Design Agentic Systems. These principles are especially useful for designing identity and access controls for autonomous systems.
• OWASP Top 10 for Agentic Applications for 2026. OWASP describes major cybersecurity risks in agentic systems and serves as a threat model for selecting and prioritizing security controls.

The key challenge here is finding the combination that works best for your company as none of these approaches provide an in-depth vendor-agnostic guideline the way NIST does for traditional zero trust. However, the approaches are complementary. Your cybersecurity developers can pick and choose controls from each framework to build a system that works for your tasks and agents.

Core controls for implementing zero trust in AI agents

Picking the right controls and mechanisms is one of key issues of enforcing zero trust for autonomous AI agents, followed closely by implementing them correctly and maintaining them as agents evolve.

As a company with deep AI development and cybersecurity expertise, we at Apriorit prefer systematic zero trust adoption that starts at AI agent design. However, it’s also possible to make an existing agent follow zero trust principles. In both cases, we focus on implementing the solutions described below.

1. Agent identity and inventory management

Zero trust requires every actor to have a verifiable identity. An agent may operate under different authority depending on its owner, task, and execution context. Moreover, AI agents quickly become a part of corporate shadow IT with shared business accounts and personal agents that employees create. IBM found that in 2026, shadow AI were involved in 43% of data breaches IBM examined.

On top of that, traditional IAM tools struggle to secure access for agents that can act independently, on behalf of users, or through other agents. Reusing employee credentials or generic application accounts obscures accountability and makes it difficult to trace an action back to the agent and authority behind it.

Based on our experience, the following practices help establish reliable agent identities and maintain an accurate inventory:

• Register every agent as a distinct identity, including its owner, purpose, connected tools, data access, and autonomy level.
• Detect and restrict shadow agents by preventing unregistered agents from accessing protected resources until they have an accountable owner and approved identity.
• Establish clear delegation chains with on-behalf-of authentication so downstream systems can identify the agent, the authorizing user or service, and the task being performed.
• Issue short-lived, task-scoped credentials using mechanisms such as OAuth 2.0 Token Exchange (RFC 8693), SPIFFE/SPIRE, and audience-restricted tokens with task ID claims. Make sure to add seamless credential refresh so that agents don’t stop during long-running tasks.
• Maintain immutable audit logs. Connect every authentication, delegation, and action to the relevant agent, task, and authorizing identity.

2. Per-request access control

Many implementations grant agents broad, persistent access to all potentially useful tools and data. It’s convenient from a user’s perspective as an agent can require access to different resources and data based on its task. From a security perspective, it creates a wide attack surface in case of agent compromise.

Static role-based controls won’t solve the problem because an authorized agent can still use an allowed tool for an unintended purpose. Instead, enforce the following:

• Per-call tool authorization. Check whether the requested action is necessary for the task and what the context behind the agent’s activity is before allowing it to continue.
• Policy-as-code approach. Use policy engines such as Open Policy Agent with Rego or Cedar to express authorization rules as machine-readable, version-controlled policies. Tools like this can help you evaluate agent-to-tool access, agent-to-agent delegation, and the originating user’s authority as separate policy layers.
• External policy enforcement. Place policy enforcement points at tool and MCP gateways, and combine them with egress controls so agents cannot bypass authorization. Evaluate each request against the full task context and keep authorization decisions outside the agent.

3. Human approval workflows for AI agent activity

Security of AI agents requires careful balance between static decision approval for better automation and human review of high-risk actions. Reviewing each agent decision would greatly improve its security but kill any automation benefit.

The following practices help balance automation with human control:

• Assign autonomy levels to agents to define whether an agent can only recommend actions, prepare them for approval, or execute them independently within set boundaries.
• Define risk scores for different types of agent actions and assign mandatory human review for high-risk actions.
• Bind approval to the exact action and request a new decision if the agent changes the target, parameters, or scope after approval.

For a more detailed guide, refer to the Agentic AI Autonomy Levels and Control Framework by CSA. It explains necessary controls for each level of agent autonomy and provides practical advice on multi-agent governance.

4. Monitoring agent behavior

Traditional security monitoring and SIEM software looks for known indicators of compromise, while AI agents can behave unpredictably even doing the same task. That’s why evaluating isolated API calls or final outputs may not reveal goal hijacking, tool misuse, or gradual behavioral drift.

The following practices help security teams detect suspicious agent behavior:

• End-to-end agent tracing. Record the agent’s assigned task, model calls, retrieved context, tool requests, authorization decisions, inter-agent messages, errors, and final result as one auditable execution trace.
• External telemetry collection. Build a separate orchestration and observability layer with independent data sources and policy enforcement points. Store security-relevant telemetry in a tamper-evident system using append-only or WORM storage and signed logs to prevent modification by agents. Consider adopting OpenTelemetry’s GenAI semantic conventions to standardize agent telemetry. Define retention policies carefully to balance forensic value, storage costs, and privacy requirements.
• Context-aware anomaly detection. Look for deviations across an entire task rather than treating every unusual action as malicious. For example, accessing a new repository may be legitimate for one assigned task but suspicious when the agent’s goal, authorizing user, or delegated authority doesn’t justify it.

5. Failure and compromise containment

In multi-agent systems, one misaligned or compromised agent can affect other agents and tools through delegated tasks. Applying traditional sandboxing and blocking may harm an agent’s efficiency as it may have legitimate reasons for blocked connections.

Containment should therefore operate at the agent, task, and session levels. Here’s how you can enforce it:

• Sandboxed agent execution inside isolated environments such as microVMs or hardened container sandboxes (Firecracker or gVisor), with access limited to only the data, network destinations, tools, and agents required for the assigned task. Each sandbox should be configured according to the agent’s purpose. Use ephemeral filesystems, avoid persisted credentials, and enforce default-deny egress policies.
• Agent and tool segmentation where an agent can communicate with a limited list of agents, APIs, and tools. If a cross-boundary interaction is needed, validate it at an external gateway.
• Automated isolation based on risky agent behavior. Use the behavioral signals to suspend tool access, revoke active credentials, or move the agent into a restricted mode.
• Manual activity review for contained agents that can result in restarting it with a clean execution state and newly issued permissions.

Ensuring AI agent security with Apriorit

Designing protected and compliant AI agent takes real development expertise, and Apriorit’s developers have just what you need.

As a company that’s been building AI and agentic solutions for years, we have the knowledge, practical understanding, and pre-configured tools to deliver the agent that fits your company. You can rely on our expertise in:

• AI development and customization. We’ll help you identify fitting formats and autonomy levels for your agentic AI system. Our engineers will design and integrate custom AI agents into your infrastructure with all security controls in plays to keep your business operational and compliant.
• AI consulting. Our development and business analysis experts will help you assess the security posture of your existing agentic AI system, identify potential security gaps in it, and plan their elimination.
• Cybersecurity-focused development. We focus on protecting every step of our development process with extra security measures, so that your ideas and code stay secure at any SDLC stage.
• Building cybersecurity products and mechanisms. As a company with 20+ years of experience in building security systems and features, we know the best ways to protect your data and infrastructure, as well as ensure security compliance.
• Integration with corporate and legacy systems. AI agents require deep, reliable, and performant integrations with many corporate solutions. We know how to design them in a secure and the least obstructive way.

FAQ