Confidential AI: what zero trust misses during workload execution

TL;DR: Zero trust still leaves a blind spot after access is granted, because AI workloads process prompts, model weights and proprietary data in memory during execution, according to Fortanix. The next control question is runtime trust, where attestation and confidential computing become the boundary that matters most.

Editorial analysis by NHI Mgmt Group, based on content published by Fortanix: “What Comes After Zero Trust? The Answer is Confidential AI”.

Key questions

Q: How should security teams implement zero trust for workloads and AI agents?

A: Start by giving each workload or agent a verifiable runtime identity, then enforce request-level policy and issue short-lived credentials only after the identity and context checks pass.

Q: Why does Confidential AI matter for security teams?

A: Confidential AI matters because it protects sensitive data and model workloads while they are being processed, not only when stored or transmitted.

Q: What are the signs that a company is relying too much on perimeter security for AI access?

A: A company is over-relying on perimeter security when AI agents already hold valid credentials, can reach multiple internal systems, and security confidence is weakest for machine-to-machine connections.

Practitioner guidance

• Separate access approval from runtime assurance Document zero trust as the entry control and add a distinct control for workload execution so sensitive AI assets are not treated as safe once authentication succeeds.
• Require attestation before releasing sensitive keys Make key release conditional on verified enclave state so inference systems only receive secrets after the runtime environment passes trusted execution checks.
• Inventory where AI workloads handle sensitive material Map prompts, model weights, embeddings and outputs to the environments that process them, then flag shared GPU and hybrid deployments as higher-assurance workloads.

Bottom line: Zero trust still leaves AI runtime exposure unresolved, because authentication does not protect the point where prompts, model weights and outputs are processed.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →