Article -> Article Details

Zero Trust was built around a straightforward security question: Should this identity be allowed to access this resource?

That question remains essential, but enterprise AI is introducing another one: What should an AI system be allowed to do once access has been granted?

This distinction matters as organizations move beyond conversational AI toward systems capable of retrieving enterprise information, calling APIs, generating code, interacting with applications, initiating workflows, and making recommendations that influence business decisions. Agentic AI pushes the issue further because an AI agent may perform a sequence of actions without requiring human approval at every step.

An authenticated AI agent with legitimate access can still create risk if its permissions are too broad, its instructions are manipulated, or its actions exceed the purpose for which access was originally granted.

Zero Trust therefore needs to evolve beyond controlling entry into systems. In AI-enabled environments, enterprises increasingly need to govern identity, data access, permissions, actions, and decision authority together.

The emerging challenge is not simply "never trust, always verify." It is determining how much autonomy a machine should receive, under what conditions, and when human intervention must remain mandatory.

Why AI Changes the Traditional Zero Trust Model

Traditional Zero Trust architectures primarily evaluate signals surrounding an access request.

Organizations may consider:

• User identity
• Authentication strength
• Device posture
• Location
• Requested resource
• Existing privileges
• Behavioral risk

Based on those signals, access is granted, restricted, or denied.

AI complicates this model because access may be only the beginning of an interaction.

Consider an enterprise AI agent connected to a customer relationship management platform. The agent may need permission to retrieve customer information to summarize an account. But should the same permission allow it to modify records, export customer data, change account ownership, or trigger an external communication?

Those are different levels of authority.

The same problem appears across software development, cloud administration, finance, customer support, and other AI-enabled workflows.

As AI becomes capable of acting rather than merely answering, enterprises need security policies that control not just resource access, but permitted decisions and actions after access.

AI Agents Create a New Identity Security Challenge

AI agents should not be treated as invisible extensions of the employees who use them.

They increasingly function as distinct machine identities.

An agent may interact with several systems, maintain credentials or tokens, invoke APIs, access different datasets, and perform actions across a workflow. Security teams therefore need to understand exactly which identity is responsible for each interaction.

This requires clear attribution.

Organizations should be able to determine:

• Which AI agent initiated an action
• Which user or business process authorized it
• Which credentials were used
• What information the agent accessed
• Which tools or APIs it invoked
• What changes it made
• Whether human approval was required

Without this visibility, organizations risk creating a new class of privileged identities whose activities are difficult to govern or investigate.

Least Privilege Must Apply to AI Actions

Least privilege has traditionally focused on limiting what users can access.

For AI, organizations need to become more granular.

An agent that can read a database may not need permission to write to it. An AI assistant that prepares a payment request should not necessarily be able to approve the payment. A coding agent may need to create a pull request without receiving authority to deploy directly into production.

This introduces the concept of action-level least privilege.

AI permissions should be aligned with the specific purpose of the agent and restricted to the minimum set of actions required to complete that purpose.

Organizations should consider separating permissions such as:

• Read
• Create
• Modify
• Delete
• Export
• Execute
• Approve
• Publish

The distinction becomes particularly important for high-impact operations.

Zero Trust in an AI environment should ask more than whether the agent has access. It should continuously evaluate whether the specific action being attempted is appropriate within the current context.

Enterprise Data Needs Context-Aware Protection

AI systems derive much of their value from access to enterprise information.

Retrieval-augmented generation, knowledge assistants, copilots, and autonomous agents may connect to document repositories, databases, collaboration platforms, SaaS applications, and internal APIs.

That connectivity creates a security challenge.

An employee may be authorized to access individual documents but use an AI assistant to retrieve and synthesize information across thousands of files. An agent may combine datasets that were never intended to be analyzed together. Sensitive information could also appear in generated outputs if retrieval permissions are poorly configured.

Zero Trust principles should therefore follow the data into AI workflows.

Security controls need to consider:

• Data classification
• User permissions
• Agent permissions
• Retrieval scope
• Business purpose
• Output destination
• Sensitivity of generated responses

The goal is to prevent AI from becoming a shortcut around controls that already govern enterprise information.

Human Approval Becomes a Security Boundary

Not every AI decision should carry the same level of autonomy.

Low-risk activities, such as summarizing internal documents, may require minimal intervention. Actions affecting financial transactions, production environments, privileged access, customer data, or critical infrastructure may require explicit human authorization.

Human approval should therefore be designed as a deliberate control rather than added only after an incident exposes the need for it.

Organizations can establish autonomy tiers based on consequence.

An AI system might be permitted to:

1. Recommend an action.
2. Prepare an action for review.
3. Execute a low-risk action within predefined limits.
4. Request approval before executing a high-impact action.
5. Never execute certain actions autonomously.

This provides a practical way to connect Zero Trust with AI governance.

The higher the potential consequence, the stronger the verification and approval requirements should become.

Continuous Verification Must Include Agent Behavior

Authenticating an AI agent at the beginning of a session does not establish permanent trust.

Agent behavior can change because of altered instructions, compromised integrations, manipulated inputs, excessive permissions, or unexpected interactions between connected systems.

Continuous verification therefore needs to examine what AI systems actually do.

Security teams should monitor for behaviors such as:

• Unexpected data retrieval
• Unusual API calls
• Attempts to access prohibited resources
• Sudden changes in action volume
• Privilege escalation attempts
• High-risk transactions outside normal workflows
• Actions inconsistent with the agent's assigned purpose

When behavior exceeds established boundaries, organizations should be capable of restricting permissions, terminating sessions, revoking tokens, or requiring human approval.

For AI, continuous verification increasingly becomes continuous authorization.

Industry Spotlight: Technology & Telecommunications

Technology and telecommunications organizations are well positioned to experience this challenge early because AI is being incorporated across software engineering, network operations, cloud management, customer service, and internal productivity workflows.

An AI agent assisting engineers, for example, could potentially interact with code repositories, development environments, ticketing systems, and cloud infrastructure.

Giving the agent one broad identity across those systems creates unnecessary exposure.

A Zero Trust approach separates capabilities according to purpose, limits privileges, monitors agent activity, and introduces approval requirements before consequential changes reach production.

This allows organizations to expand AI automation without creating uncontrolled machine privilege.

Industry Spotlight: Government & Public Sector

Government and public sector organizations face a particularly important balance between AI innovation and accountability.

AI systems may interact with sensitive records, public services, administrative workflows, and information governed by strict access requirements. In these environments, knowing that an AI system was authenticated is insufficient.

Agencies need clear evidence of what information an AI agent accessed, why access was permitted, what action followed, and who ultimately authorized consequential decisions.

Applying Zero Trust principles to agent identities and actions can help public sector organizations introduce AI capabilities while maintaining traceability, least privilege, and human accountability.

Building Zero Trust for an Agentic Enterprise

Organizations do not need to replace their existing Zero Trust programs. They need to extend them.

A practical strategy should prioritize:

• Assigning unique identities to AI agents
• Avoiding shared or unnecessarily broad credentials.
• Applying least privilege at both resource and action levels
• Limiting data retrieval according to user and agent permissions
• Establishing autonomy levels based on business consequence
• Requiring human approval for high-impact actions
• Monitoring agent behavior continuously
• Logging AI actions for investigation and accountability
• Securing APIs and tools available to agents
• Providing rapid mechanisms for revoking agent access
• Regularly reviewing agent permissions as workflows change.

Security, identity, AI governance, application, and business teams should establish these boundaries together.

A technically valid action may still create unacceptable business risk. Decision authority therefore cannot be determined solely by whether an API request is authenticated.

Organizations strengthening their Zero Trust Security strategy should increasingly account for machine identities and autonomous AI activity alongside traditional human access.

The Future of Zero Trust in the AI Era

AI is likely to make enterprise authorization more dynamic.

Instead of static permissions assigned primarily according to roles, future access decisions may increasingly consider an agent's purpose, current task, requested action, data sensitivity, behavioral history, and potential business consequence.

This could lead to security architectures built around:

• Agent-specific identities
• Just-in-time machine privileges
• Context-aware authorization
• Continuous behavioral risk scoring
• Transaction-level approval policies
• Automated permission expiration
• Real-time agent isolation
• Human-in-the-loop controls for consequential actions.

In this model, Zero Trust becomes more than an access architecture.

It becomes a framework for controlling how digital authority is delegated to intelligent systems.

Final Thoughts

AI does not make Zero Trust obsolete. It exposes where the traditional interpretation of Zero Trust needs to expand.

Verifying identity before granting access remains fundamental. But an enterprise cannot assume that every action taken after authentication is automatically trustworthy—especially when autonomous systems can retrieve information, invoke tools, and make changes at machine speed.

The next phase of Zero Trust therefore needs to answer three questions continuously:

Who or what is requesting access?

What is it trying to do?

Should it have the authority to make that decision or take that action right now?

For human users, these questions strengthen existing access controls. For AI agents, they define the boundaries of safe autonomy.

As enterprises give AI systems greater responsibility, the organizations that maintain the clearest boundaries around identity, permissions, actions, and human accountability will be better positioned to capture the benefits of autonomous AI without surrendering control.

Zero Trust began by challenging implicit access. In the AI era, it must also challenge implicit authority.

Know More