Zero trust access at the last mile now has NHI implications

At a glance

What this is: This is an analysis of why last-mile zero trust must extend beyond login and network access to govern session activity, data controls, and non-human access.

Why it matters: It matters because IAM, PAM, and NHI programmes increasingly have to control what identities do after authentication, especially when AI agents use private applications and internal APIs at machine speed.

Context

Most zero trust programmes still treat authentication as the main security decision, then hand off control after the user or workload enters the application. That leaves a governance gap at the last mile, where sensitive actions, data movement, and delegated access actually occur, especially for NHI and agentic AI workflows.

The article frames a practical problem for identity teams: AI agents are now acting as access consumers to internal tools, databases, and APIs, but the enforcement model in many environments still assumes a human session with a stable login boundary. Once access becomes session-level and machine-paced, network-centric controls are no longer enough.

Island's argument is that the control plane has to follow the work, not just the connection. That makes this a zero trust and NHI governance issue at the same time, because the same policy model must now account for unmanaged devices, human users, and non-human identities under one set of session controls.

Key questions

Q: How should security teams extend zero trust beyond authentication and network controls?

A: Security teams should treat zero trust as a continuous access decision, not a one-time login check. That means pairing authentication with policy-based authorization, data-level controls, and real-time risk evaluation across the full user journey. The goal is to verify identity, context, and entitlement at each access point so policy can adapt before sensitive data is exposed.

Q: Why do AI agents create risk in Zero Trust environments that were built around human behavior?

A: AI agents create risk because Zero Trust depends on observable patterns, and agents do not behave like people. Their access shifts with the task, they can spawn sub-agents, and they can be manipulated into acting on an attacker’s behalf. That means authentication may succeed while the real compromise happens at the instruction or delegation layer.

Q: What breaks when session controls are missing in zero trust access models?

A: Zero trust loses much of its value if authentication happens once and the session is then treated as implicitly safe. Without step-up checks, reauthentication, and logging, sensitive actions can occur inside a trusted session with little visibility or containment.

Q: How do teams govern unmanaged devices, contractors, and AI access under one model?

A: They need a policy engine that evaluates identity, device posture, and context at the point of use, then applies the same session rules across managed devices, BYOD, contractors, and non-human identities. The goal is consistent governance without forcing every access path into the same operational shape.

Technical breakdown

Why network-level zero trust stops short at the application boundary

Traditional VPNs and first-generation ZTNA solve different parts of the same problem, but both still leave a gap between authentication and what happens inside the session. VPNs expose too much network scope. ZTNA narrows the scope to applications, yet enforcement often ends once access is granted. That means clipboard use, downloads, screenshots, and internal actions can remain outside policy if the control point sits above the device and below the application. For identity practitioners, the issue is not just reachability. It is whether the policy engine continues to govern the session after entry.

Practical implication: Treat application access and session control as separate design problems, not one control with two labels.

How MCP-driven AI access changes the identity boundary

Model Context Protocol gives AI agents a standard way to call tools and data sources, which makes agent activity look operationally similar to human application use but at machine speed and scale. That matters because a login event does not describe the full identity behaviour of an agent that can query data, chain actions, and repeat calls without pause. The old assumption that access can be understood from the point of authentication breaks down when the subject is a non-human identity performing multiple tool calls after the initial grant. Governance has to account for runtime access behaviour, not just the fact that a session exists.

Practical implication: Model agent access as a governed runtime sequence, not as a one-time authentication event.

Why session-level data controls are the missing layer in zero trust

A policy that only decides whether an identity may enter an application does not control what happens next. Session-level controls extend enforcement into the browser or endpoint so clipboard copying, downloads, printing, watermarking, and screenshot capture can be governed while the session is active. That is important for unmanaged and BYOD devices, where the enterprise cannot rely on device trust alone. It is also important for non-human access, because the same policy logic has to distinguish between legitimate tool use and data movement that exceeds the intended task boundary. In practice, zero trust is only complete when the action layer is also controlled.

Practical implication: Anchor data governance to the session itself, especially where unmanaged devices or AI access are involved.

Breaches seen in the wild

• CitrixBleed 2 2025: CitrixBleed 2 leaked NetScaler session tokens from memory, letting attackers hijack VPN sessions and skip MFA at 100+ organisations.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Last-mile zero trust is now an identity governance problem, not just a network architecture problem. Once access decisions move from the perimeter into the session, the central question becomes what an identity is allowed to do after authentication. That is where human users, contractors, and NHI workflows converge. Practitioners should now judge zero trust by whether it governs action, not just entry.

Session-level enforcement is the named concept that matters here. The article describes a control model where clipboard, download, print, and screenshot actions remain subject to policy throughout the session. That matters because these are the points where sensitive data actually leaves the protected environment. The implication is that identity programmes need action-scoped controls, not only access-scoped ones.

AI agents expose the limit of authentication-centric access models. A human login event produces a stable subject for review, but an agent can make repeated tool calls, query data, and chain actions long after the initial grant. That means IAM assumptions built around a single authenticated user no longer map cleanly to runtime non-human behaviour. Practitioners need governance that tracks delegated action paths, not just authenticated principals.

Unified policy across managed, unmanaged, and non-human access is becoming the baseline. The article ties browser, endpoint, and AI access into one policy engine because fragmented controls cannot keep pace with modern work patterns. That is a signal that zero trust programmes will increasingly be judged on consistency across device classes and identity types. The practical conclusion is that control boundaries must follow the workload, wherever it runs.

Last-mile control is where Zero Trust Architecture proves or fails. If policy stops at application admission, the architecture still permits uncontrolled session behaviour. That breaks the premise that access decisions should remain continuously enforceable. Practitioners should treat last-mile governance as part of the zero trust design itself, not an optional overlay.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Session-level control is becoming the deciding layer in zero trust. As more work moves into browsers, endpoints, and machine-to-machine access paths, the main question is no longer whether an identity can connect. It is whether the programme can still govern what happens after connection, including data movement and delegated action paths.

AI agents make access governance a runtime discipline. A human user leaves an audit trail that can be reviewed later. An agent may consume and release privileges inside the same task, which means the old review cadence misses the behaviour entirely. Identity teams should prepare to shift more policy decisions to issuance time and session time.

Zero trust is no longer credible if it stops at the perimeter of the app. The practical test now is whether the control plane can follow unmanaged devices, contractors, and NHIs through the full session lifecycle. That is where ZTNA, data control, and identity governance converge.

For practitioners

• Define last-mile control points Map where your current zero trust design stops. If policy ends at application entry, add controls for clipboard, download, print, screenshot, and other session actions that can move data out of the protected workspace.
• Classify non-human access paths Inventory which internal applications, APIs, and data sources are already consumed by AI agents or other NHIs. Separate those paths from human access so their approval, monitoring, and revocation logic can be governed differently.
• Test unmanaged-device assumptions Review where BYOD, contractor, and acquired-team access depends on device trust that the enterprise cannot actually enforce. Prioritise flows that need application-specific access with session controls instead of broad network reach.
• Rework policy around runtime behaviour Use the same access event to govern not only login but the actions taken inside the session. That is especially important where AI agents can call tools repeatedly and make high-volume requests without a stable human operator.

Key takeaways

• Most zero trust deployments still leave a gap between application entry and governed session behaviour, and that gap now matters for both human and non-human identities.
• AI agents intensify the problem because they can make repeated tool calls and access private resources at machine speed after the initial login event.
• The control that changes the outcome is last-mile session governance, where access decisions continue to enforce data movement and action boundaries.

Key terms

• Last Mile Of Zero Trust: The last mile of zero trust is the point where an authenticated user interacts with data after access has been granted. It focuses on controlling what the user can do next, including printing, copying, pasting, screenshotting, screen sharing, and viewing sensitive fields. This is where data extraction risk often appears.
• Session-Level Data Controls: Controls that restrict what a user, contractor, or agent can do with data after access has been granted. Examples include download blocking, clipboard restrictions, screenshot prevention, and print controls. In modern identity programmes, these are part of enforcement, not separate convenience features.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Machine-speed access: Machine-speed access is entitlement use by service accounts, workloads, or AI-driven workflows that can act faster than human review cycles. It matters because governance designed for people often assumes delays, approvals, and retriable oversight that do not exist for non-human actors.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.