Agentic artificial intelligence marks a new stage in the evolution of digital systems.
According to a recent KPMG study, agents are now integrating as true teammates to manage key operational tasks, offering new opportunities for automation and efficiency. They can analyze information, make decisions, and interact with applications or data without constant human intervention.
Nevertheless, this growing autonomy also raises new security challenges. Companies must be able to identify, control, and monitor their agents just as they would a human user.
In this context, where there is a strong link between AI potential and high autonomy, the historical principles of Zero Trust remain relevant and form a fundamental framework for the use of AI agents.
The iteration of these principles requires equipping each agent with a verifiable identity, an appropriate level of access, and behavior in line with defined security policies. Applying Zero Trust to agent-based environments thus enables the full potential of AI while limiting the risks associated with its autonomy.
Giving Agents an Identity, a Core Condition of Zero Trust
The extension of Zero Trust principles to agents begins with granting them an identity. Like human users, organizations must know precisely which agent is acting, for the account of which user, and the context in which an action is performed.
Anthropic recommends using digital certificates for identity verification and mutual TLS for authentication. However, this solution has drawbacks. Many agents developed or downloaded by companies cannot manage certificates.
Moreover, mutual TLS may hinder traffic interception needed to verify compliance with security policies in place. Organizations seek a reliable identity that links the agent to the human user who uses it. This merged identity proves essential for creating policies that implement precise control systems. Developers must not create, store, or share access tokens among agents, as they represent a particularly vulnerable target in the event of an attack.
Once a solid identity foundation is in place, a Zero Trust strategy can define the appropriate level of access depending on the resources involved. Anthropic refers to the OWASP principle of “least authority” (least agency), which corresponds to applying the principle of least privilege to agents. An agent should therefore possess only the capabilities strictly necessary for its operation and be able to perform only actions aligned with its role and objective.
The application of this principle is achieved notably through role-based and context-based access controls. Security policies can map agents’ identities to roles and define precisely the conditions allowed for each access: time, location, level of confidentiality, risk score, application instance used, or characteristics of the requested resource. This approach helps limit what agents can do and prevents a compromised or misused agent from accessing resources that do not fit its intended use.
Visibility and Access Controls as the First Line of Defense
Without well-established DevSecOps practices, most organizations must gain visibility across their entire AI environment and implement effective control systems. Moreover, the secure use of agentic AI requires adding a layer of policies and governance governing the use of this AI and the interactions of its agents.
Zero Trust strategies start from the assumption that companies know all of their resources, systems, and data. Since the widespread adoption of AI, this premise has become less tenable, making in-transit inspection an indispensable complement.
In-transit inspection enables continuous identification of the MCP servers and clients in use, along with their key characteristics. It also facilitates assigning risk scores to public MCP servers to identify the AI tools and integrations that pose the greatest security and compliance risks.
Visibility, however, is not limited to detection. Anthropic’s book reminds us that access controls prevent unauthorized actions, but ongoing monitoring remains essential to understand the events detected and determine whether agent activity appears normal or suspicious.
Just as with human users, those users can now define a behavioral baseline for agents, then detect anomalies or signs of malfunction to adapt control policies.
Verifying Agent Intent to Prevent Misuse
There is always a risk that an agent may behave in an unpredictable manner, with potentially significant harmful consequences. In the generalized Zero Trust approach to AI, every action should start from the assumption that malicious actors are already exploiting a vulnerability.
Organizations using AI must therefore detect and monitor traffic between MCP servers, clients, functions, hosts, data sources, and development tools. In parallel, they keep in mind the internal traffic among all these elements, while logging MCP events, including sessions, requests, function responses, and deployments.
One aspect of Zero Trust strategies that is sometimes overlooked is identifying why a person or an agent acts in a certain way or holds the authorization to do so. Assessing every agent’s intent should become a mandatory step in any Zero Trust strategy. This requires filtering the data leveraged by agents, as they cannot distinguish between legitimate instructions and malicious commands.
Automated controls thus provide an additional layer of defense by analyzing traffic in real time to neutralize prompt-injection attacks, jailbreaking, or attempts to exfiltrate data. They also enable content moderation and block dissemination of content subject to intellectual property constraints.
As agents become more autonomous, the ability to govern their identity, their access, and their intentions becomes a central element of any security strategy. Even with these additions, the heart of Zero Trust remains that the right people and the right agents have the right level of access to the right resources, at the right time, for the right reasons.
Steve Riley is the Field CTO at Netskope
