Zero Trust For AI Agents Is Right, But It's Missing A Word: Authorization

Julian Durand Chief Security Architect at Intertrust Technologies.

Autonomous AI agents are arriving in the enterprise whether security teams are ready or not, so it is good news that the frameworks are catching up. Anthropic published “Zero Trust for AI Agents,” a thoughtful guide to applying zero trust to agentic systems, and it is worth any CISO’s time.

It offers one test worth taping to the wall: when evaluating a control, ask whether it makes an attack impossible or merely tedious. Against an adversary with unlimited patience and near-zero cost per attempt—which is what an AI-driven attacker is—tedious is not a defense.

The framework deserves to be built on rather than picked at. Still, I found one gap worth naming, a familiar one that I’ve watched the energy sector wrestle with for a decade in operational technology. AI agents turn out to be that problem in new clothes.

Stripped down, many of the guide’s strongest recommendations come to two things:

1. Isolate the agent through sandboxes, segmentation, least agency and a contained blast radius.

2. Prove its identity using cryptographic credentials, short-lived scoped tokens and hardware-bound keys.

Both are necessary, but neither is sufficient on its own. The guide’s own list of threats points to the gap: even an isolated, strongly authenticated agent can still create operational risk if its authority is not properly governed.

The Missing Layer: Authorization At The Point Of Action

Consider three attacks the guide describes:

1. Tool chaining, where an agent is steered into combining legitimate tools in a harmful sequence
2. The confused deputy, where a lower-privilege agent persuades a higher-privilege one to act
3. Unscoped privilege inheritance, where a manager agent passes its full access to a worker

In each case, the agent may be acting within its granted permissions, as the guide itself notes: traditional access controls can’t prevent tool misuse “because the agent operates within its granted permissions.”