How do agentic AI controls differ from traditional Zero Trust practices?

Why Traditional Zero Trust Falls Short for Agentic AI

Traditional zero trust is built to reduce implicit trust at the network and identity boundary, but agentic ai changes the threat model. Once an agent is authenticated, it may chain tool calls, query systems it has never used before, and act on incomplete or evolving instructions. That means “who logged in” is only the starting point. Current guidance suggests the real control point is runtime behaviour, not session establishment, as reflected in NIST AI Risk Management Framework and OWASP Agentic AI Top 10.

NHIMG research on AI agents: the new attack surface shows why this matters operationally: 80% of organisations report agents already performed actions beyond intended scope, and only 52% can track and audit the data agents access. In other words, a Zero Trust posture that ends at login can still leave an autonomous workload free to move, copy, expose, or misuse data after access is granted. In practice, many security teams encounter agent misuse only after sensitive actions have already been executed, rather than through intentional control design.

How Agentic Controls Change the Enforcement Model

Agentic controls shift the security boundary from “authenticate and allow” to “authenticate, observe, and decide repeatedly.” That usually means combining workload identity, short-lived credentials, and policy evaluation at each tool invocation. A useful mental model is that the agent should prove what it is, what it is trying to do, and whether that action is permitted right now. For identity proof, many organisations are exploring workload-native approaches such as Guide to SPIFFE and SPIRE, alongside standards-based tokens and ephemeral secrets.

In practice, agentic controls often include:

• Just-in-time credentials issued for a single task and revoked automatically when the task ends.
• Context-aware authorisation that evaluates the requested action, target system, data sensitivity, and current risk state.
• Runtime policy engines such as OPA or Cedar that can block unsafe tool calls before they execute.
• Logging of tool usage, data access, and delegated actions so incident response can reconstruct the agent’s path.

This is more demanding than traditional ZTA because the control plane must understand execution context, not just identity assurance. NIST’s SP 800-207 Zero Trust Architecture is still relevant, but agentic deployments need a stronger runtime policy layer that accounts for autonomous intent and tool chaining. These controls tend to break down when multiple agents share broad service accounts because attribution, revocation, and action-level containment become ambiguous.

Common Variations and Edge Cases

Tighter runtime controls often increase operational overhead, requiring organisations to balance safety against latency, developer friction, and incident triage complexity. There is no universal standard for this yet, so guidance is evolving across the market rather than settling on one control stack. Some teams apply strict allowlists to every tool call, while others use tiered enforcement that only tightens scrutiny around sensitive actions such as payments, data export, code deployment, or privilege escalation.

The tradeoff becomes sharper in multi-agent systems, where one agent delegates work to another and each step may look benign in isolation. Static RBAC can still be useful for coarse boundaries, but it is not sufficient on its own when the agent’s behaviour is goal-driven and non-deterministic. Current best practice is to combine Zero Trust principles with agent-specific guardrails from OWASP NHI Top 10 and CSA MAESTRO agentic AI threat modeling framework, especially where the agent can invoke external tools or access production data. NHIMG’s research on the Ultimate Guide to NHIs is a useful reference point for aligning ephemeral credentials and identity governance. The model is strongest when runtime policy is enforced per action, and weakest when autonomous systems are granted broad standing access in environments with weak telemetry.

Related resources from NHI Mgmt Group

• What is Agentic AI and how does it differ from traditional generative AI?
• When does just-in-time access reduce risk for agentic AI, and when does it fall short?
• How should security teams govern machine identity credentials in agentic AI environments?
• How does the rise of AI identities impact traditional IAM systems?