Zero trust for AI agents exposes the missing identity layer

At a glance

What this is: This analysis says zero trust for AI agents only works when every agent has runtime identity, narrow task-scoped access, and explicit tool boundaries.

Why it matters: IAM and security teams need this distinction because agent governance fails when controls assume stable privileges, static credentials, or human-paced review cycles.

Context

Zero trust for AI agents depends on a missing identity layer: cryptographic runtime identity for each agent and workload, plus credentials that can be issued and revoked at the pace of execution. Without that foundation, policy statements about least privilege and tool boundaries remain largely aspirational.

The article argues that machine-speed behaviour changes the security model, because controls that only slow an attacker down do not hold when agents can select tools, invoke MCP servers, and move across sessions autonomously. For IAM and NHI programmes, the real question is whether access is governed at issuance time or only reviewed after the fact.

That distinction matters most where AI systems are already connected to production services, internal data, and delegated tools. The governance gap is not whether zero trust applies, but whether identity infrastructure can actually express and enforce it for non-human actors.

Key questions

Q: How should security teams implement zero trust for workloads and AI agents?

A: Start by giving each workload or agent a verifiable runtime identity, then enforce request-level policy and issue short-lived credentials only after the identity and context checks pass. The practical goal is to remove standing secrets and make access decisions at the point of use, not at deployment time.

Q: Why do static secrets create more risk for AI agents than for traditional workloads?

A: Static secrets create more risk for AI agents because agents act autonomously, at high speed, and often across multiple systems. A copied token or certificate can be replayed long after issuance, while the agent may already have chained actions elsewhere. The longer the credential lives, the larger the attack window and the harder attribution becomes.

Q: What breaks when access review processes are used for autonomous agent governance?

A: Access review processes break when the system under review changes access and action paths within the same operating session. Human-paced recertification assumes privileges remain stable long enough to be observed and attested. For autonomous agents, the control can arrive after the risky action has already completed, which makes the review mostly historical.

Q: How do tool chaining attacks change AI agent governance?

A: They show that the risk is not only whether a tool is individually trusted, but whether legitimate tools can be combined into an unsafe sequence. Security teams need to govern the agent-to-tool path, not just the endpoint service, because an authorised action chain can still expose data or trigger unintended operations.

Technical breakdown

Runtime identity is the control plane for AI agents

Zero trust for AI agents only becomes enforceable when each agent instance has a cryptographic identity that can be verified at access time. That identity needs to appear in logs, policy decisions, and access requests so the control plane can distinguish one agent from another, even when they use the same model or application. Static API keys and embedded secrets cannot provide that property because they are portable, reusable, and hard to bind to a specific runtime instance. The architecture therefore shifts from credential possession to identity assertion plus policy enforcement at the moment of use.

Practical implication: Treat runtime identity as a prerequisite for agent access, not an optional logging enhancement.

Why static secrets fail under machine-speed attack

The article’s core warning is that controls built around friction, such as manual rotation or delayed review, degrade quickly when an attacker or agent can operate at machine speed. A secret that lives in code, a lockfile, or a workflow can be found and reused faster than human operators can respond. Short-lived, narrowly scoped credentials change the economics because compromise windows shrink from durable reuse to brief execution windows. In practice, the security outcome depends less on how often a secret is rotated and more on whether it can be recreated on demand and invalidated immediately after task completion.

Practical implication: Replace reusable credentials with short-lived issuance paths tied to task scope and runtime context.

MCP and tool chaining expand the identity boundary

The article highlights a subtle but important failure mode: an agent does not need to break authentication if it can be induced to call legitimate tools in a harmful sequence. MCP servers, memory, and delegated tool access create an identity boundary that extends beyond the model itself into connected services and prompts. A compromised descriptor, poisoned memory entry, or chained low-privilege tools can redirect behaviour without altering the underlying credentials. That means the relevant control is not only who authenticated, but which tools, scopes, and call paths the runtime is allowed to assemble.

Practical implication: Inventory and govern tool-to-agent relationships as part of the identity surface, not as app-layer plumbing.

Threat narrative

Attacker objective: The objective is to misuse a legitimate AI agent pathway to reach data or services that should never have been in scope for that task.

1. Entry occurs when an attacker or malicious dependency reaches the AI agent’s tool and identity surface through exposed secrets, compromised descriptors, or poisoned context.
2. Escalation follows when the agent is allowed to invoke legitimate tools or MCP servers with access broader than the task requires, turning valid credentials into overreach.
3. Impact occurs when the agent copies data, redirects actions, or chains tools in a way that preserves legitimacy while breaking containment and auditability.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime identity, not model sophistication, is the missing control: zero trust for AI agents fails when the organisation cannot bind action to a cryptographically verifiable agent instance. The article is right to treat identity as the foundation because policy without runtime identity cannot distinguish authorised agent behaviour from impersonation, replay, or tool misuse. The practitioner implication is that agent governance starts with verifiable identity, not with prompts or guardrails.

Least Agency is the right lens for agent access: least privilege is necessary but insufficient when agents can choose tools and sequence actions at runtime. Constraining what an agent can do, how often it can do it, and from where it can do it is a stronger control statement than generic access minimisation. This is the correct framing for NHI governance when autonomy and tool use are coupled, because the security question becomes one of permitted action paths, not just allowed resources.

Control-by-friction does not scale against autonomous execution: rate limits, awkward ports, and manual review steps are weak substitutes for enforceable issuance and scope boundaries. That assumption was designed for human-paced operations, and it fails when access is acquired and exercised inside machine-speed sessions. The implication is that teams must stop treating delayed detection as a boundary and start treating issuance-time policy as the boundary.

Tool chaining creates identity blast radius: once an agent can combine multiple legitimate tools, the security unit is no longer the individual service but the path between services. This changes how blast radius should be measured, because the risk sits in the composition of authorised actions rather than in any single credential. Practitioners should map agent-to-tool dependencies as first-class governance objects and not assume each tool remains safe in isolation.

Anthropic’s framework usefully exposes the governance gap, but the market still lacks enough deployable runtime identity infrastructure: the article makes clear that many teams are below Foundation before they begin. That is not primarily a model-safety problem, it is an identity and access problem that has to be solved before zero trust for agents becomes operational. The field now needs stronger runtime attribution, policy enforcement, and lifecycle governance for agents and other non-human workloads.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Authorisation Guide

What this signals

Runtime identity is now the deciding governance layer: teams that cannot attribute actions to a specific agent instance will struggle to enforce zero trust for AI systems in production. The practical shift is from review-based governance to issuance-based governance, where identity is created, scoped, and revoked at execution time.

Least Agency becomes the better control objective for AI agents: access should describe what an agent can do, not just what data it can reach. That is a material change for IAM and NHI teams because policy must now constrain action paths, tool usage, and scope drift as a single problem.

Access review processes assume privilege persists long enough to be certified; autonomous actors can acquire and release credentials within a single task, leaving nothing durable to review. That is why zero trust for agents has to be enforced at issuance time, not after the fact.

For practitioners

• Discover every non-human identity at runtime Build an inventory from actual runtime behaviour across cloud, on-premises, and hybrid environments so you can see agents, workloads, and shadow identities that static scans miss.
• Replace static secrets with short-lived issuance Prioritise workloads where embedded keys, tokens, or API secrets are reusable and issue task-scoped credentials at the moment access is needed, then expire them immediately after use.
• Define explicit access policies for each agent Write approved actions, prohibited actions, scope limits, and escalation triggers at the access layer so an agent cannot improvise permissions from natural-language instructions alone.
• Map tool chaining risk to the identity surface Trace which tools, MCP servers, and downstream services each agent can combine, then remove any path where legitimate access could create an unsafe sequence of actions.

Key takeaways

• Zero trust for AI agents depends on cryptographic runtime identity and short-lived credentials, not on static secrets or delayed review cycles.
• The main risk is not only unauthorised access, but legitimate tool chaining and scope drift inside otherwise trusted agent workflows.
• IAM teams should move policy enforcement to the point of access and treat agent-to-tool relationships as part of the identity surface.

Key terms

• Runtime Identity: Runtime identity is the practice of making identity and authorization decisions at the moment an action occurs. For agents and workloads, it means access is validated against live context, not only against the identity state set during onboarding or provisioning. That makes accountability and scope enforcement possible inside fast-moving workflows.
• Least Agency: The agentic equivalent of least privilege, the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
• Just-in-Time Scoped Access: Just-in-Time Scoped Access is temporary authorization issued only when a task needs it and revoked immediately after use. For autonomous or agentic systems, the control is stronger than periodic rotation because it reduces standing access and narrows the time window for misuse.
• MCP Descriptor: An MCP descriptor is the configuration object that tells an AI agent which tools or services are available and how to reach them. If it is compromised or poisoned, an agent can be redirected toward unsafe tool calls even when the underlying credentials appear valid.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.