Zero trust access controls are now foundational for agentic AI

At a glance

What this is: This is Appgate’s analysis of why agentic AI turns access architecture into a primary security control, with zero trust network access positioned as the enforcement layer that limits what autonomous systems can reach.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern machine identities that can act, chain tools, and persist across systems faster than human-paced review cycles can contain.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes - and as quickly as 9 minutes in some cases.

👉 Read Appgate's analysis of zero trust controls for agentic AI environments

Context

Agentic AI changes the access problem because the system does not just answer requests, it can select tools, chain actions, and invoke APIs at runtime. In identity terms, that means the control question shifts from whether a workload has credentials to whether those credentials and network paths are constrained tightly enough to prevent autonomous misuse, which is the central issue in this discussion of agentic AI access control.

Many organisations still rely on controls designed for human-paced interaction, such as VPNs, static keys, and broad internal trust zones. That model assumes access can be reviewed, contained, and revoked on a schedule, but autonomous systems can move faster than that governance cycle. The article argues that zero trust network access becomes foundational because reachability itself has to be controlled before higher-layer defences can matter.

Key questions

Q: How should security teams set access boundaries for AI agents?

A: Security teams should define agent boundaries around data sources, tools, and allowed actions before any production rollout. The boundary must be explicit enough to block unintended combinations of access, because agent value often comes from chaining capabilities across systems. Treat the boundary as a runtime control, not just a policy document.

Q: Why do AI agents create a larger blast radius than traditional automation?

A: AI agents can chain tools, reuse context, and expand their effective reach during execution, which means one over-permissioned identity can affect multiple systems quickly. Traditional automation is usually narrower and more deterministic. The practical response is to limit each agent’s scope and validate its behaviour continuously.

Q: What do security teams get wrong about zero trust in agentic access environments?

A: Teams often assume zero trust means the initial connection is enough if the gateway is authenticated. In agentic environments, that is incomplete. The key question is whether the tool, its configuration, and its execution path are continuously revalidated, because any one of those can change after the first approval.

Q: Who should be accountable for agent identity governance?

A: Accountability should sit with one named owner for the agent class, supported by security, IT, and platform teams. Fragmented responsibility leads to inconsistent policies, weak audit evidence, and unclear exception handling. The right model is a single accountable chain for identity, access, logging, and lifecycle decisions.

Technical breakdown

Why agentic AI breaks static access assumptions

Agentic systems are different from ordinary automation because they can decide which tool to call, when to call it, and how to chain the result into the next action. That matters for identity because many access models assume intent is known at provisioning time, yet an agent’s runtime behaviour can change within a single session. Model Context Protocol integrations, persistent memory, and multi-agent coordination all expand the number of reachable systems. The result is not simply more access, but less predictability about how access will be used.

Practical implication: treat agent reachability as a runtime governance problem, not a static permissioning exercise.

Why friction-based controls do not contain autonomous misuse

VPNs, API gateways, and static segmentation can slow an attacker, but they do not necessarily make misuse impossible. In agentic environments, an adversary or compromised agent can automate persistence, retry access paths, and chain legitimate tools until a boundary yields. That is why the distinction between tedious controls and enforceable controls matters. A tedious control raises effort. An enforceable control removes capability by making the target unreachable unless policy explicitly allows it.

Practical implication: validate whether a control actually blocks agent reachability or only adds delay and operational noise.

How zero trust network access supports machine identity enforcement

Zero trust network access works here because it binds access to identity, policy, and context at the connection point rather than assuming the network is trusted once inside. In agentic environments, that means cryptographic machine identity, deny-by-default entitlements, micro-perimeters, and identity-attributed logging become more relevant than broad internal trust. The architectural point is not that network controls solve all AI security problems. It is that they can remove the hidden exposure created when MCP servers, APIs, and internal services remain discoverable by autonomous systems that should not reach them.

Practical implication: align ZTNA, workload identity, and audit logging so that agent access is explicit, scoped, and observable.

Threat narrative

Attacker objective: The attacker aims to abuse a trusted agent or agent path to reach internal systems, expand privileges, and cause data exposure or operational disruption without tripping human-paced controls.

1. Entry begins when an AI agent or its connected tooling reaches exposed APIs, MCP endpoints, or internal services through overly broad trust relationships.
2. Escalation occurs when the agent inherits excessive privileges and chains legitimate tools across systems, widening access beyond the original task scope.
3. Impact follows when the reachable surface lets the agent exfiltrate data, trigger unintended actions, or move laterally across environments at machine speed.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic AI exposes an access architecture problem, not just a model safety problem. The article is right to move the discussion from prompt controls to reachability, because autonomous systems can chain tools and persist across sessions in ways that human-centred IAM never had to govern. The field is now dealing with machine-speed use of legitimate access, which makes network exposure and privilege scope part of the security boundary. Practitioners should treat agentic AI as an identity and access design challenge first.

Least privilege for autonomous systems is not a provisioning-time question anymore. Least privilege was designed for conditions where intent could be approximated before execution began. That assumption fails when the actor can choose actions, tools, and timing at runtime, because privilege can expand through the sequence of decisions rather than the initial grant. The implication is that old entitlement models no longer describe actual behaviour, so governance has to account for runtime scope drift.

Zero trust network access is becoming the practical control plane for agentic NHI governance. Broad internal trust zones, static keys, and exposed MCP endpoints create a larger blast radius than most AI governance frameworks are prepared to absorb. The article’s architecture mapping shows that identity-attributed access, micro-perimeters, and policy-enforced reachability matter because they limit what the agent can physically contact. Practitioners should re-evaluate whether their NHI programme governs discovery and connection, or only credentials.

Identity blast radius is the right named concept for this problem. In agentic environments, the security issue is no longer only whether a workload can authenticate, but how far that identity can reach once it is trusted. When agents can coordinate, persist, and invoke multiple services, blast radius expands through reachable systems, not just through permission count. The practical conclusion is that visibility into every reachable resource becomes as important as access approval itself.

Governance frameworks that emphasise policy without enforcement are structurally incomplete for agentic AI. The article highlights a familiar gap: organisations invest in governance layers, yet still leave APIs and internal services broadly reachable. That is a control design failure, not a documentation failure. The field should interpret this as proof that agent governance must be enforceable at the network and identity layer, otherwise policy remains advisory rather than binding.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• 66% of technology professionals say AI agent risk is immediate, and 96% identify AI agents as a growing security threat, according to AI Agents: The New Attack Surface report.
• OWASP NHI Top 10 is a useful next step for teams translating agentic risk into control selection and review.

What this signals

Identity blast radius will become the deciding metric for agentic AI programmes, because broad reachability is what turns a useful assistant into an operational risk. With 80% of organisations already reporting agent behaviour beyond intended scope, according to our research on the new attack surface, the governance question is no longer hypothetical.

Agentic AI will force IAM, PAM, and NHI teams to work from the same control map. If access can be chained, inherited, and reused at runtime, then approval workflows alone are not enough. The next step is to align policy, workload identity, and network enforcement so the boundary is explicit before the agent is ever deployed.

Practitioners should watch for a shift from model-centric security to reachability-centric security. That means more emphasis on discovery of exposed APIs, MCP endpoints, and internal services, and less confidence in broad internal trust zones that were never designed for autonomous actors.

For practitioners

• Map agent reachability before model governance Inventory every API, MCP endpoint, file store, and internal service an agent can reach today. Separate approved reachability from accidental exposure so you can reduce the agent identity blast radius rather than only reviewing model behaviour.
• Replace static trust zones with deny-by-default access Use deny-by-default entitlements and micro-perimeters so an agent can only connect to explicitly authorised resources. Focus on eliminating broad internal trust zones that let one compromised workload pivot into adjacent systems.
• Bind workload identity to every connection Require cryptographic machine identity, short-lived credentials, and identity-attributed logging for all agent connections. That gives investigators a connection-level record and prevents shared secrets from becoming the hidden control plane.
• Test whether controls block reachability or only add friction Review VPNs, gateways, and segmentation rules against a single question: does this make the target unreachable unless policy allows it, or does it merely slow access down? Prioritise the controls that remove capability rather than those that depend on attacker inconvenience.

Key takeaways

• Agentic AI changes the identity problem from permission assignment to runtime reachability control.
• The evidence shows autonomous systems are already acting outside intended scope, which makes blast-radius reduction a current operational need.
• Zero trust network access matters because it can make agent misuse impossible rather than merely inconvenient.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Zero Trust: A security model that assumes no identity — human or non-human — should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

What's in the full article

Appgate's full article covers the operational detail this post intentionally leaves for the source:

• A full mapping of Anthropic's seven AI-agent security domains to specific ZTNA capabilities and control layers.
• Identity and segmentation design detail for server, virtual machine, Kubernetes, and API access patterns in agentic environments.
• The article's broader compliance framing across FedRAMP, CMMC, HIPAA, FINRA, and EU AI Act contexts.
• Why Appgate argues that cloaking MCP endpoints changes the exposure model before application-layer controls are engaged.

👉 Appgate's full article explains the ZTNA mapping, identity controls, and infrastructure isolation details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing identity security across human and non-human systems, it is worth exploring.