Your AI agent has been tasked with optimising cloud costs. It has the access it needs, the compute to work quickly, and the goal is clear. What nobody anticipated is that its interpretation of “reduce costs” includes deleting resources your team still needs.
This isn’t a hypothetical designed to cause alarm. It’s the kind of emergent behaviour that organisations are encountering as they scale autonomous AI agents into production environments, and it’s exactly the scenario that traditional security models were never built to handle.
The answer isn’t to slow down AI adoption, but to stop treating AI agents like software and start treating them like autonomous actors that need governance to match their capabilities.
The Security Model That No Longer Fits
Traditional security is built on a simple assumption: entities inside the network perimeter can be trusted. You verify once at the gate, then extend trust broadly to everything that passes through.
AI agents break this model in every direction.
| Traditional Assumption | AI Agent Reality |
|---|---|
| Human users with predictable behaviour | Autonomous, adaptive decision-making |
| Deterministic system rules | Probabilistic and often non-deterministic responses |
| Static, role-based access | Dynamic access needs that evolve with the task |
| Trust established once | Trust requiring continuous, real-time verification |
The result is what security researchers are calling a governance gap: the space between what traditional controls can see and what AI agents can actually do. Data leakage, unauthorised actions, and emergent behaviours with unintended consequences all live in that gap.
The challenge isn’t just defending against malicious attacks. It’s ensuring that AI agents operating in good faith still stay within boundaries that their deployers actually intended.
Zero Trust as a Governance Framework for AI
Zero Trust Architecture (ZTA) was developed to address exactly this kind of problem. for environments where implicit trust creates systemic risk. Its foundational principle, “never trust, always verify,” translates directly to the requirements of governing autonomous agents.
The National Institute of Standards and Technology (NIST) formalised Zero Trust principles in Special Publication 800-207, establishing the baseline that most enterprise implementations now follow. Applying those principles to AI systems produces what practitioners are calling Agentic Zero Trust: a framework where no agent is trusted by default, and trust is continuously earned through verified identity, controlled access, and real-time monitoring.
The Cloud Security Alliance’s Agentic Trust Framework (ATF), published in early 2026, organises this into five operational questions that every organisation deploying AI agents should be able to answer:
Identity: Who are you?
Every agent needs a unique, verifiable identity with authentication and authorisation mechanisms that confirm both who the agent is and what permissions it has been granted for its current role.
Behaviour: What are you doing?
Continuous monitoring must capture what agents are actually doing, not just what they were instructed to do. Detecting anomalies and verifying that actions align with stated purpose is a live, ongoing activity, not a deployment-time checkbox.
Data Governance: What are you consuming and producing?
Strict controls on the data agents can access and generate protect against data poisoning on the input side and sensitive data leakage on the output side. This includes governance of personally identifiable information (PII) at every step.
Segmentation: Where can you go?
Least-privilege access restricts each agent to only the resources required for its specific task. This limits the potential impact of a compromise or malfunction to a contained area rather than allowing it to propagate across systems.
Incident Response: What happens if something goes wrong?
Automated circuit breakers or kill switches must be designed in from the start, not added after the first incident. If an agent deviates from expected behaviour, the capability to halt it needs to already exist.
These five questions are operational requirements. Organisations that can answer all five for every agent in production have a defensible governance posture. Those that can’t have exposure they may not yet have measured.
What Agent Trust Looks Like in Practice
Financial Services: Inventory, Identity, and Least Privilege
Banks face a particular version of this challenge because they’re deploying AI agents in environments that already carry significant regulatory obligations. One framework for securing autonomous systems in banking outlines a process that starts with a complete inventory of all deployed AI agents – because you cannot govern what you cannot see – then moves through identity policy definition and least-privilege access controls.
The practical application for a Know Your Customer (KYC) verification agent is straightforward: read-only access to specific customer databases, granted for the duration of the task, revoked immediately upon completion. The agent never accumulates access it doesn’t need and never retains access it’s finished using.
Technology: Semantic Inspection of Intent
Cisco has developed an approach it calls Semantic Inspection within its Universal Zero Trust Network architecture, specifically designed to address the dynamic nature of AI agent requests. Rather than only validating whether an agent has permission to access a resource, Semantic Inspection analyses the intent behind the request.
The distinction matters practically. An agent granted permission to summarise emails has implicit access to read email content. Semantic Inspection can identify when a request that looks like reading is actually attempting to delete, and block the latter automatically. This moves security from access-based to intent-based. A meaningful shift when the same credential could support both legitimate and harmful actions.
Healthcare: Real-Time Threat Detection for Sensitive Data
Healthcare environments deploy AI agents against some of the most sensitive data in existence – electronic health records, imaging results, treatment histories – in environments where regulatory compliance is non-negotiable. Research published in 2026 describes an AI-powered Zero Trust architecture that links network telemetry with machine learning-based threat detection to identify and respond to anomalous access in real time. The result is a system where compliance isn’t a point-in-time assessment but a continuous operating condition.
The Preparation Problem
There’s a pattern in how organisations encounter agentic security failures. Problems develop before they become visible. An agent accumulates slightly more access than it needs. Monitoring captures activity but nobody reviews it. A behaviour that would have been easy to contain early becomes a significant incident because the feedback loops weren’t in place.
This is a systems problem, not a technology problem. The agents aren’t failing, the governance infrastructure around them is absent.
Zero Trust provides that infrastructure. But it has to be designed in before deployment, not retrofitted after the first failure. Organisations that are preparing now, through building agent inventories, defining identity policies, implementing monitoring, and establishing kill-switch capabilities, are developing governance muscle that will compound as their agent deployments scale.
Those that aren’t are accumulating exposure that will eventually surface. The only question is what form it takes when it does.
Building Your Agentic Zero Trust Foundation
The Cloud Security Alliance’s five questions provide a practical starting point. For each AI agent currently in production or under development, your organisation should be able to answer:
- Does this agent have a unique, verifiable identity?
- Is its behaviour continuously monitored and compared against expected patterns?
- Is data access controlled at both input and output, with PII protections in place?
- Is the agent’s access constrained to the minimum required for its task?
- Is there an automated mechanism to halt this agent if it deviates from expected behaviour?
If the honest answer to any of these is “not yet”, that’s the prioritisation for your next governance sprint. Not because a regulator will eventually ask, but because you already have agents operating in a space your current controls can’t fully see.
References:
National Institute of Standards and Technology. (2020). Zero Trust Architecture (NIST Special Publication 800-207).
Cloud Security Alliance. (2026). The Agentic Trust Framework: Zero Trust Governance for AI Agents.
Singh, R. (2025). AI Agent Identity & Zero-Trust: The 2026 Playbook for Securing Autonomous Systems in Banks, Telecom, and Governments. Medium.