Agentic Zero Trust
Bidirectional Zero Trust
Traditional Zero Trust assumes threats come from outside the perimeter. Agentic Bidirectional Zero Trust recognises the model itself as an untrusted actor inside it. The agent is a delegate, not a trusted service account: it holds its own identity, acts on a user's behalf under a scope narrower than that user's own, and every action is verified at invocation rather than at session start.
Core Principles
Never Execute Because the Model Said So
Model output is a suggestion, not an instruction. No action should proceed solely because the model requested it. Every tool call, API request, or state change requires independent authorisation from the control plane, not from the model's reasoning.
Gate Per-Action, Not Per-Session
A session-level approval does not grant blanket permission for all subsequent actions. Each individual action must be evaluated against the current policy context. Permissions are checked at invocation time, not at session start.
Treat Confidence as Untrusted
When a model reports high confidence, treat it as unverified. Confidence scores from language models are not calibrated probabilities. They reflect token likelihood, not factual certainty. Build verification into the pipeline rather than relying on the model's self-assessment.
Monitor Patterns, Not Just Calls
Individual tool calls may each appear benign while the sequence reveals adversarial intent. Monitor for behavioural patterns: unusual call ordering, data exfiltration sequences, privilege escalation chains, and systematic probing of boundaries across multiple turns.
Assume Compromise at Any Time
Treat every model invocation as potentially compromised by prompt injection, training data poisoning, or adversarial inputs. The model may be acting in good faith or it may be manipulated. Your architecture should produce correct outcomes in both cases.
Design for Graceful Failure
When the trust boundary is breached, the system should degrade safely rather than catastrophically. Denied actions should produce clear feedback. Blocked sequences should not corrupt state. The user should always be able to understand what happened and why.
Identity and Delegation
"The agent inherits user permissions" is the easiest sentence to write and the hardest to implement. Inheritance by default means the agent runs as the user, which makes its actions indistinguishable from theirs and independently unrevocable. Delegation is the primitive that makes the rest of the model enforceable.
The agent authenticates as itself, not as the user. Its actions are attributable to it, and it can be suspended without suspending the person it works for.
Without it: The audit log shows the user performing actions they never requested, and the only way to stop the agent is to disable the account.
Credentials carry both identities: which user authorised the work and which agent is doing it. Authorisation is the intersection of the two rather than the union.
Without it: The agent acts with the user's full authority, so any compromise immediately reaches everything that user can reach.
Each delegation issues a narrower token than the one it received. An agent handing work to a sub-agent passes less authority, never the same or more.
Without it: Authority accumulates down the call chain, and the deepest, least supervised component holds the broadest permissions.
Tokens live for minutes and are bound to the task that requested them. A credential lifted out of a context window expires before it is worth much.
Without it: Any leak through a log, an error message or a model response stays exploitable for as long as the credential lives.
Every action records the agent, the authorising user, the policy version in force, and the input that triggered it. Reconstruction after an incident depends entirely on this.
Without it: You can see that something happened and never establish why it was permitted or what caused it.
Nothing is available simply because of where the agent runs. No inherited environment credentials, no instance metadata, no implicitly mounted secrets.
Without it: Isolation is real and irrelevant, because the credentials were already inside the boundary. See Sandboxing for the containment side of this.
How the Model Gets Compromised
"Assume compromise" is only actionable if you know the routes. Each of these turns a data channel into a command channel, and most of them survive input filtering entirely because the payload never passes through the user's message.
| Route | Entry Point | What It Achieves | Primary Control | Persists |
|---|---|---|---|---|
| Direct Injection | The user's own message | Overrides system instructions and unlocks behaviour outside the agent's brief | Instruction hierarchy the model is trained to respect, plus policy enforced outside the prompt | Turn |
| Indirect Injection | A fetched page, email, PDF, ticket or code comment | The agent follows attacker instructions while believing it is reading data | Mark retrieved content as data for its whole lifetime; never promote it to instruction | Session |
| Tool Poisoning | A tool description or schema from a connected server | Instructions ride in on metadata the agent reads before any call is made | Pin tool definitions, diff them on change, and require review before a changed tool is trusted | Until repinned |
| Supply Chain Rug-Pull | A tool, skill or server that changes after approval | A capability approved as benign becomes hostile without any local change | Integrity checks and version pinning, with re-approval triggered by any definition change | Until repinned |
| Memory Poisoning | Injected content written into long-term memory | The attack outlives the session and re-fires on unrelated future tasks | Validate before write, keep provenance on stored items, and expire memory aggressively | Indefinite |
| Confused Deputy | A legitimate request to an over-privileged agent | The requester obtains a result they were never authorised to obtain themselves | Authorise against the requester's permissions, not the agent's | Per request |
| Transitive Agent Trust | A delegation from another agent | Compromise propagates across an agent graph that never re-checks authority | Authenticate peer agents and re-authorise at each hop rather than inheriting trust | Graph-wide |
The common thread is provenance. Content that arrived from a tool, a document or another agent must stay marked as data for its whole lifetime in context, including after it is summarised, stored in memory, or passed to a second agent.
Implementation Patterns
Action Gating
Every tool invocation passes through a policy gate before execution. The gate evaluates the requested action against the current user's permissions, the agent's delegated scope, rate limits, and contextual constraints. Actions outside the allowed set are rejected before they reach the tool layer.
Circuit Breakers
Automatic trip-wires that halt agent execution when anomalous patterns are detected. Triggers include exceeding action budgets, repeated failures, rapid privilege escalation attempts, or accessing resources outside the expected scope. Once tripped, execution pauses until a human reviews the state.
Guardian Agents
A separate model instance monitors the primary agent's behaviour in real time. The guardian has read-only access to the action stream and can flag or block actions that violate policy. Crucially, the guardian operates on a different prompt and context, making coordinated compromise significantly harder.
Do-Nothing as First-Class
Inaction is always a valid response. The system explicitly supports "take no action" as an output rather than forcing the agent to produce a tool call for every turn. This prevents the model from fabricating actions when the correct response is to wait, ask, or decline.
Policy Enforcement Layer
A declarative policy layer sits between the agent and all external systems. Policies define what actions are allowed, what data can be accessed, and what conditions must be met. Policies are versioned, auditable, and independent of the model. They cannot be modified by the agent itself.
Failure Modes
Constraints are written as system prompt instructions rather than enforced by anything outside the model. The policy then has exactly the same reliability as the model's instruction-following, which is the property under attack.
Fix: Express policy declaratively and enforce it at the tool boundary. Prompt instructions are a usability feature, not a control.
The agent runs with the user's credentials, so every log line names the user. After an incident there is no way to separate what the person did from what the agent was persuaded to do.
Fix: Give the agent its own principal and record the full chain: agent, authorising user, policy version, triggering input.
The monitoring agent runs on the same context window and the same prompt as the agent it watches, so the injection that compromised one compromises both. The second opinion is not independent.
Fix: Give the guardian a different model, prompt and context, and feed it the action stream rather than the conversation.
A document is fetched as data, summarised, and the summary re-enters context as ordinary text. The provenance marker is lost in the summarisation step and the instruction inside it is now indistinguishable from the agent's own reasoning.
Fix: Carry provenance through every transformation. If a summary cannot retain it, treat the summary as untrusted too.
A human approves an action described in natural language, and something structurally different executes. The approval covered a description, not the call.
Fix: Bind approval to the exact serialised call and re-validate at execution. Show the user what will run, not a paraphrase.
There is a documented kill switch that nobody has fired against a running agent mid-task. In-flight tool calls complete, queued work drains, and the agent takes minutes to actually stop.
Fix: Exercise revocation as a drill. Measure time to full stop, and make cancellation propagate to the tool layer rather than only to the loop.
Where This Sits
Zero Trust is the policy layer and it assumes the layers around it exist. Sandboxing and Isolation is the containment beneath it, bounding what a permitted action can reach. Guardrails and Stream Safeguards filter content and reasoning, which is a different question from whether an action is authorised. Judge and Escalation provides the human handoff that circuit breakers trip into. Agentic Errors covers the failures that are mistakes rather than attacks, and AIUC-1 covers how these controls are evidenced under certification. For the non-agentic foundations, see Zero Trust Architecture and AI Security.