Anthropic’s zero trust guide shows AI agent security baselines rising

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Pomerium's blog post: Anthropic's zero trust guide moves AI agent security from static safeguards to continuously verified controls across identity, access, observability, and governance.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern agent behaviour at execution time, not just at provisioning or review time.

Context

AI agent security now depends on whether identity controls can keep up with machine-speed decisions. In this guide review, Pomerium argues that Anthropic’s zero trust model shifts the question from whether agents are dangerous to whether current governance can still verify, constrain, and attribute what they do.

The core governance gap is that many programmes still treat access as a stable state that can be reviewed later. For AI agents, access is often exercised in bursts, with tokens, tool calls, and delegated permissions appearing and disappearing faster than traditional review cycles can observe them.

That makes the identity problem more than a policy issue. If the control model cannot bind agent identity, scope, and action together in real time, zero trust becomes a label rather than an operating model.

Key questions

Q: How should security teams implement zero trust for workloads and AI agents?

A: Start by giving each workload or agent a verifiable runtime identity, then enforce request-level policy and issue short-lived credentials only after the identity and context checks pass. The practical goal is to remove standing secrets and make access decisions at the point of use, not at deployment time.

Q: Why do static API keys create risk for AI agent access?

A: Static API keys create risk because they are long-lived, reusable, and difficult to tie to a specific action. In an agentic environment, that means the same secret can be replayed across tools, sessions, or workloads long after the original task is complete. Short-lived delegated credentials give teams a much better chance of limiting scope and preserving accountability.

Q: What breaks when AI agent access is reviewed only after the fact?

A: After-the-fact review leaves a gap between action and containment. If an agent can already reach a dataset, API, or SaaS system, the damage may be done before a human sees the alert. Runtime checks reduce that gap by stopping unauthorized actions before they execute.

Q: How do continuous authorisation and just-in-time access differ for AI agents?

A: Continuous authorisation rechecks the decision before each meaningful action, while just-in-time access limits how long elevated permission exists. For agents, both matter because the risk is not just who got access, but whether the access still matches the task at execution time.

Technical breakdown

Cryptographic identity for AI agents

Anthropic’s guide treats a label or application name as insufficient for agent identity. A cryptographic identity, such as a verifiable certificate or equivalent machine-rooted credential, gives the system a way to prove that the caller is the same agent across requests, tools, and services. That matters because agents are not just users with different interfaces. They are runtime actors that may spawn sub-tasks, switch tools, and invoke services in patterns that look legitimate until identity is anchored to a trustworthy root. Without that anchor, attribution breaks and access decisions become guesswork.

Practical implication: require verifiable cryptographic identity before any agent can reach production tools or sensitive APIs.

Least agency, not static least privilege

The guide’s least agency model goes beyond assigning a role and calling it controlled. It assumes permissions should be narrow, moment-scoped, and re-evaluated as the task changes. That is why role-based access with deny-by-default is only the starting point, while continuous authorisation and just-in-time elevation are the mature patterns. For AI agents, intent is not fully known at provisioning time, so static least privilege often becomes either too broad to be safe or too narrow to be useful. The control needs to move closer to execution, where the agent’s actual request can be judged.

Practical implication: scope agent permissions to the current task and force re-evaluation before each sensitive action.

Observability and machine-speed response

Anthropic’s model separates auditing from traceability. Auditing records what happened on the systems agents touched, while traceability captures the agent’s internal path, including tool calls and delegated steps. That distinction matters because a security team can only contain what it can reconstruct. The guide also draws a hard line on response: automate the bookkeeping, not the judgment. Machines can collect artefacts, open parallel investigations, and draft reports, but containment, disclosure, and customer-impact decisions still need human control. This is especially important when agents act faster than humans can interpret telemetry.

Practical implication: instrument both external logs and internal agent traces, then keep human approval on containment decisions.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cryptographic identity is now the minimum viable control for AI agents. The guide’s strongest signal is that a human-style account label no longer proves anything about an agent. When multiple tools, services, and sub-agents can be invoked in one workflow, identity has to be rooted in something the attacker cannot trivially forge. Practitioners should treat this as a baseline shift in non-human identity governance, not an advanced option.

Least privilege is being outpaced by least agency. Static permission models assume the actor’s purpose is knowable at provisioning time. AI agents break that assumption because task intent can change during runtime and permissions may be consumed in a sequence that no pre-set role can fully anticipate. The practitioner conclusion is that access scope must be tied to execution context, not just identity creation.

Review-cadence governance fails when access is exercised faster than it can be observed. Access reviews, recertification, and periodic attestations presuppose a stable privilege state that lasts long enough to be certified. That assumption weakens when an agent can obtain, use, and discard access within a single task. The governance implication is that control has to move from after-the-fact review to issuance-time verification.

Identity-based isolation is becoming more important than perimeter segmentation for agents. The article’s architecture section makes clear that relying on network boundaries alone is a weak backstop when downstream services accept any authenticated caller. The practical test is whether the receiving service enforces caller-specific policy at the point of access. If it does not, the blast radius of an agent compromise stays too large.

Automation should accelerate evidence handling, not decision authority. The guide is right to separate machine-led investigation from human-led containment. That separation is not conservative process theatre. It is a governance boundary that keeps response speed without handing final authority to the same automated system being investigated. Practitioners should preserve that line in incident playbooks and agent operating policies.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Read next: Top 10 Agentic AI Identity Issues

What this signals

Least agency will become the practical test for agent security programmes. Agent governance is moving beyond the old question of whether a system can authenticate. The real question is whether the system can prove that each tool call is still justified at the moment it is made, which shifts control design toward runtime enforcement and task-scoped permissions.

Identity-bound execution will matter more than perimeter logic. Teams that still lean on network segmentation as the main backstop will find that downstream services are the real enforcement point. If the receiving service does not verify the caller’s identity and scope, the agent’s route through the network is less important than the trust it is granted at the edge of the service.

Governance cadence must compress to match agent behaviour. Review cycles built for human operators will keep missing access that starts and ends inside a single workflow. That means security teams need issuance-time checks, traceability, and human approval boundaries that operate at machine speed rather than audit-speed.

For practitioners

• Require cryptographic agent identity Replace label-based or shared identities with verifiable machine credentials before any agent reaches sensitive APIs, tools, or data sources.
• Move from reviews to issuance-time controls Treat periodic access review as supplementary only. Use continuous authorisation and just-in-time elevation for agent actions that change risk mid-task.
• Separate auditing from traceability Capture external activity on target systems and internal agent traces separately so investigators can reconstruct both impact and decision path.
• Constrain response authority to humans Let automation gather artefacts, correlate alerts, and draft reports, but require human approval for containment, disclosure, and service shutdown decisions.

Key takeaways

• AI agent security is shifting from static access models to continuously verified identity, scope, and response controls.
• The article’s core warning is that review-based governance cannot keep pace with agent behaviour when privilege is consumed inside a single task.
• Practitioners should prioritise cryptographic identity, runtime authorisation, and human-controlled response boundaries for production agents.

Key terms

• Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
• Cryptographic Identity: Cryptographic identity is a trust model in which authentication depends on verifiable keys, certificates, or signed assertions rather than shared secrets alone. It is essential for machines and agents because it gives the organisation a stronger way to prove identity and revoke access quickly.
• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.
• Identity Traceability: Identity traceability is the ability to link each action back to a specific identity, authorisation path, and time window. It is essential when humans, service accounts, and AI agents all operate in the same environment and auditors need a defensible record.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or NHI governance programme, it is worth exploring.