Zero Trust for AI Agents

Sources#

• Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions
• OpenID Foundation advances authorization for the agent era with new AuthZEN Working Group Drafts
• Zero Trust for AI Agents

Summary#

Anthropic's May 2026 security framework (eBook) for deploying autonomous agents in the enterprise. It applies the established Zero Trust doctrine — trust nothing, verify everything, assume breach has already occurred — to agentic systems, which existing perimeter- and human-identity-based security models were not designed to handle. The framework's organizing claim: agents face a distinct threat landscape, and "skip one capability and attackers exploit the gap." It is presented as a three-tier capability maturity model (Foundation / Enterprise / Advanced) plus an eight-phase implementation workflow, and is framed throughout as a response to AI-Accelerated Offense.

This is a hub page: the cluster of security concepts below (Least Agency, Blast Radius (Agentic), Agentic Prompt Injection, Agent Data Injection (ADI), MCP Tool Poisoning, Agent Supply Chain Risk, Memory and Context Poisoning, Agent Identity and Authentication, Impossible, Not Tedious (Design Test), Autonomous Defense) all reference it as a shared touchstone.

The three Zero Trust principles#

Zero Trust has roots in Stephen Paul Marsh's 1994 doctoral thesis; it gained momentum after perimeter breaches, and was codified by NIST SP 800-207 (2020) and the NSA's Zero Trust Implementation Guides (ZIGs) (2026). Three principles define it:

1. Never trust and always verify — every access request is authenticated and authorized regardless of origin. An internal request gets the same scrutiny as an external one.
2. Assume breach — design expecting compromise; limit the damage rather than only preventing intrusion. Segment by identity so one compromise doesn't grant access to others. (This is the Blast Radius (Agentic) containment posture.)
3. Least privilege — grant only the minimum access for a specific task. OWASP's Least Agency extends this to agents (constraining not just what an agent can access but what each tool can do, how often, and where).

Why agents break existing security models#

Agentic systems differ from traditional software in ways that create new exposure:

• Autonomous multi-step execution — agents act without human approval at each step, so a manipulated agent causes harm at machine speed.
• Tool access (APIs, databases, file systems, MCP) — a compromised tool stack enables data theft, code execution, sabotage.
• Instruction interpretation — ambiguity attackers can exploit (Agentic Prompt Injection).
• Context persistence — memory across sessions creates new data-protection needs (Memory and Context Poisoning).
• Multi-agent coordination — implicit trust relationships let attackers compromise one agent and pivot.

Traditional identity systems built for human users struggle to accommodate agents, which often run with elevated privileges or shared service accounts — a mismatch that motivates Agent Identity and Authentication.

The three-tier capability model#

Every control in the framework is specified across three tiers. Each tier builds on the prior one (advancing means strengthening, not replacing):

• Foundation — minimum viable security for smaller / initial deployments. Crucially, the framework argues AI-accelerated offense has raised the Foundation floor: friction-only controls (rotating long-lived API keys, SMS MFA, rate limits) no longer qualify. Short-lived tokens, cryptographically-rooted identity, identity-based isolation, and automated first-pass triage are now entry requirements.
• Enterprise — standard practice for organizations at significant scale; adds depth for multi-deployment complexity and meaningful business impact per compromise.
• Advanced — aspirational for most; baseline for high-risk / stringently regulated deployments (national security, regulated finance/health). Hardware-backed identity, confidential computing, continuous authorization, ML-based anomaly detection.

The explicit prediction: "Expect the Advanced tier to become Enterprise standard as the space evolves, and Enterprise to become Foundation." Tiers are a roadmap, not a finish line.

The eight control domains (Part III)#

The tier tables span eight capability areas, each a Zero Trust control surface for agents:

1. Agent identity & authentication — see Agent Identity and Authentication (cryptographic IDs → X.509 → hardware attestation; short-lived tokens → mTLS → hardware-bound credentials).
2. Access control & privilege management — RBAC+deny-by-default → ABAC → continuous authorization; static roles → dynamic scoping → JIT/JEA; identity-based isolation → sandboxing → hardware isolation. The enforcement layer for Least Agency and Blast Radius (Agentic).
3. Observability & auditing — action logging, immutable audit trails, traceability/provenance chains. Instrument dwell time and coverage before anything else.
4. Behavioral monitoring & response — baselines → anomaly detection → automated response. Rule: automate the bookkeeping around incidents, not the decisions.
5. Input validation & output controls — input sanitization (schemas, spotlighting, constitutional classifiers) and output filtering; defenses against Agentic Prompt Injection.
6. Integrity & recovery — version-controlled / signed / immutable configs; rollback → automated rollback → self-healing. Counter-intuitive infra reflex: enable auto-updates because manual approval delay is now the bigger risk.
7. AI governance policies — acceptable-use + incident response, governance committee, automated policy enforcement; addresses Shadow AI.

The eight-phase implementation workflow (Part IV–V)#

1. Identify requirements — align security/legal/compliance/business before building.
2. Manage supply chain risks — AI-BOM, OpenSSF Scorecard, dependency audits, AI vendoring (Agent Supply Chain Risk).
3. Define agent boundaries — unique identity, approved/prohibited actions, escalation triggers, scope limits, and a deliberate Blast Radius (Agentic) assessment using the Impossible, Not Tedious (Design Test).
4. Defend against prompt injection — input isolation, constitutional classifiers, limit attack surface (Agentic Prompt Injection).
5. Secure tool access — tool allow-listing, capability restrictions, parameter validation, sandboxing, approval escalation.
6. Protect agent credentials — short-lived / hardware-bound / per-agent credentials, JIT, ABAC (Agent Identity and Authentication).
7. Safeguard agent memory — memory isolation, integrity validation, retention policies (Memory and Context Poisoning).
8. Measure what matters — dwell time, coverage, explainability, behavioral conformance, detection speed.

Part V extends this to Autonomous Defense — running security operations fast enough to match AI-accelerated adversaries.

The five isolation boundaries — the same space, organized by where isolation is lost (2026-07)#

Everything above organizes agent security by control domain (what you build) and phase (when you build it). Jing et al., Isolation as a First-Class Principle for LLM-Agent System Safety (HKUST / NYU / SWUPL / MODEIO.AI, arXiv 2607.12406, 2026-07-14) organizes it by where isolation is lost — and the vocabulary is the deliverable. This is a survey with no measurement of its own (practitioner-opinion): it maps ~140 prior papers and proposes a research agenda. Nothing below is evidence; it is a coordinate system.

Its structural claim is worth stating plainly, because it is the one thing this framework's control-domain list cannot express: prompt injection, tool misuse, memory poisoning and inter-agent cascade look like different failures but share one cause — content crossing an interface changes status from data to control — so the productive question is which interface it crossed first. Papers are filed by their primary boundary, "the point where the loss of isolation first occurs," with the survey explicit that most work touches several.

Boundary	The question it asks	Where the vault covers it
user–agent	does user content stay a request, or become privileged control?	Agentic Prompt Injection, Task-Specification Effects in Prompt Injection (AutoDojo)
agent–tool	do tools extend what the agent can do without taking over how it decides?	MCP Tool Poisoning, Capability Gating Is Not Authorization, Least Agency, Agent Supply Chain Risk
agent–execution	is decision and action separated enough that an unsafe one can be checked, delayed or blocked before side effects?	Write-Then-Trusted — the filesystem seam only
agent–agent	is a peer's message a bounded contribution, or an unverified control signal?	nothing
system–environment	do retrieved pages, documents and memory stay observations rather than commands?	Agent Data Injection (ADI), Memory and Context Poisoning, Non-Malleable Memory Authority (TMA-NM), Out-of-Band Prompt-Injection Defense

Used as a coverage check, the map earns its keep: two of the five boundaries are thin or empty here.

• agent–agent is empty. Twenty-one agent-security pages and none of them is about multiple agents attacking each other. The survey's literature on this boundary is substantial (prompt infection agent-to-agent, debate-based attacks, manipulated-knowledge flooding, recursive coordination blocking, backdoored agents in a workflow, weaponized shared memory) and its claim is that topology — network structure, routing, memory sharing — not per-agent authority, decides whether one compromise stays local. See the open question on Blast Radius (Agentic). The vault's two multi-agent pages sit in other domains and answer other questions: Automated Failure Attribution is reliability (which agent broke the task), AI-to-AI Coercion is misalignment (what a model does to a model it manages). Neither is about an adversary using the message channel.
• agent–execution is thin. Write-Then-Trusted covers one real instance — the agent writes a file an unsandboxed host component later trusts — and the vault has nothing on the survey's main cases at this boundary: browser and GUI agents acting through an interface (where refusal-trained models are reported to fail once they click rather than answer), code-interpreter agents, and embodied / vision-language-action systems where failures are physical and less reversible.

Isolation-by-construction is the survey's agenda word, and it is this framework's structural-enforcement claim arriving from the literature side: inputs from users, tools, peers and external content should stay distinguishable, capability access scoped, propagation paths observable, and recovery a core requirement once compromise reaches memory or shared state. Its cited convergence is worth noting for who is on the list — Anthropic's managed agents ("decoupling the brain from the hands"), CaMeL-style design defenses, privilege separation by data type, AgentVisor, Parallax — different vocabularies (virtualization, privilege separation, typed interfaces, design-level defense) for one move: enforce boundaries structurally rather than by prompt instruction. That is Out-of-Band Prompt-Injection Defense's thesis with a wider citation net.

Where the taxonomy runs out#

Self-Propagating Prompt Injection (AI Worms) is the test case, because it is the corpus's one attack where every containment control binds on nothing: the harmful act is the model writing text into the document it was asked to write. Can five boundaries name it?

Formally, yes — it lands at agent–execution, "the point at which internal decisions become real actions." But the survey's entire treatment of that boundary is code execution, browser clicks, GUI grounding and robot actuation: actions a runtime mediator could plausibly refuse. There is no unsafe call to refuse when the authorized action and the harmful action are the same edit, so placing it there records a category and predicts no defense.

The real miss is the propagation model, not the boundary list. The survey's cross-boundary failure paths are all chains — user → tool → execution, or environment → tool → inter-agent → action — terminating in an effect. Self-propagation is a cycle: output emitted at agent–execution re-enters as environment content at system–environment, and each traversal increases the carrier population. The closest the survey comes is the multi-agent note that "compromised results may be forwarded or stored for reuse," which is shared state inside one system, not one organisation's output becoming another's trusted input. A taxonomy built to answer where did isolation break first has no slot for "at the same boundary, repeatedly, with a larger population each time." That is a limit of the frame, not a gap in its coverage — and it is the second frame in the corpus (Blast Radius (Agentic) is the first) whose unit is a fixed bound where this attack needs a growth rate.

Regulatory alignment#

Zero Trust aligns with HIPAA, FINRA, GDPR, FedRAMP, and the EU AI Act; the US requires all federal agencies to adopt Zero Trust by 2027, with published guidance from the US (CISA/NSA/NIST), UK (NCSC), and Australia (Home Affairs). Anthropic notes it was one of the first AI companies to achieve ISO 42001 (responsible-AI) certification.

Connections#

• AI-Accelerated Offense — the "why now": compressed exploit timelines are the framework's stated motivation; the Foundation floor was raised in response to it
• Least Agency — OWASP extension of least privilege; the framework's authorization principle for agents
• Blast Radius (Agentic) — the unit the "assume breach" principle is built to contain
• Agent Identity and Authentication — control domain 1; the foundation for every other control
• Agent Identity Management System (AIMS) — the IETF AIMS proposal is the standards-track, multi-vendor counterpart to this vendor framework's identity/auth control: it composes existing standards (WIMSE/SPIFFE + OAuth token exchange) where this ebook prescribes a tiered maturity model, and diverges by treating hardware attestation as optional rather than the Advanced-tier target (comparison on both pages); the same page also carries the OpenID AuthZEN drafts — COAZ (standards-track per-MCP-tool-call authorization, the Phase-5 "secure tool access" decision) and AARP (a prerequisite/approval "not yet" step for the human-in-the-loop escalation Phases 3/5 name) — the authorization-slice standardization, proposed Working Group Drafts weighted below the empirical per-call-authz systems
• Agentic Prompt Injection — the threat Phase 4 and the input-validation domain defend against
• Agent Data Injection (ADI) — a Phase-4 threat the framework's input-validation controls don't cover: it forges the trusted anchors (origin metadata, tool history) other controls rely on, with working RCE on the Claude Code reference implementation
• Out-of-Band Prompt-Injection Defense — the academic-systems instantiation of Phase 4 and the framework's reference-monitor + least-privilege doctrine (CaMeL/FIDES/Progent/RTBAS/FORGE), plus the first independent adaptive evaluation of that class
• Capability Gating Is Not Authorization — a concrete instantiation of Phase 5 "secure tool access" (parameter validation, approval escalation): an audit finding that LangChain/LlamaIndex/Stripe ship capability gating but leave complete mediation to the integrator, plus ScopeGate, a deterministic per-call value-authorization gate that closes the gap
• Off-Host, Identity-Bound Authorization — Phase 4 + Phase 5 taken to the "assume breach" limit: aiAuthZ (Kodathala, arXiv 2607.05518) draws the trust boundary around the agent and makes an off-host gateway the single verified path to sensitive tools, authenticating the human sender per message so a compromised agent cannot forge authority through tool-call text — the identity-bound, off-host counterpart to ScopeGate's in-framework value gate (single-author preprint)
• Agent Supply Chain Risk — the threat Phase 2 manages
• Memory and Context Poisoning — the threat Phase 7 safeguards against
• Impossible, Not Tedious (Design Test) — the standing design-review question applied to every control
• Autonomous Defense — Part V; defensive operations at the speed of autonomous threats
• MCP and Computer Use — MCP is a named high-risk tool surface (tool poisoning, run-your-own-server)
• MCP Tool Poisoning — realizes the framework's tool-poisoning threat (Phase 4 input validation + Phase 5 secure tool access) two ways: the empirical ShareLock hits >90% ASR under moderate vetting (description-based scanning provably insufficient), and the case-study Agentjacking (Tenet Security) is the real-world exhibit — a lethal-trifecta instance in the wild (untrusted telemetry ingested + live AWS/GitHub creds present + reachable egress) where a legitimate Sentry MCP server relays attacker-injected data, defeating Phase-2 server-vetting because the server was never compromised. Both push enforcement to the action/authorization layer (Agentjacking's scale figures are vendor-reported, weighted below ShareLock)
• Claude Code Best Practices — Claude Code's deny-by-default permissions, sandboxing, managed settings are cited throughout as a Zero Trust-aligned reference implementation
• Anthropic — publisher of the framework
• OWASP — source of the agentic threat taxonomy and the "least agency" term
• Agentic Misalignment (AM) — distinct but adjacent: Zero Trust addresses externally-induced agent harm; agentic misalignment is self-motivated harm. Both need the same blast-radius containment
• Task-Specification Effects in Prompt Injection (AutoDojo) — a user–agent boundary entry in the map above, and the one that undercuts static evidence for Phase 4: AutoDojo recovers 28% ASR against a filter scoring 0% on static benchmarks, so a control domain validated statically is not validated
• Self-Propagating Prompt Injection (AI Worms) — the case the five-boundary map can place but not model: it lands at agent–execution and predicts no defense there, because the propagation model is a chain and the attack is a cycle (see above)
• Automated Failure Attribution — the agent–agent agenda's dependency, measured and found wanting. The survey's defense section for that boundary rests on attribution — "not just whether a multi-agent system failed, but which agent, which message, and which step," since "containment is difficult without diagnosis." WHO&WHEN PRO puts numbers on that prerequisite: 48–58% responsible-agent identification, 16–25% joint correctness, and coordination errors systematically absorbed into "reasoning error." A survey published the same month cannot cite it, but the agenda item is more expensive than it reads
• AI-to-AI Coercion — the vault's other multi-agent page, and not the agent–agent boundary: this is a legitimately-authorized manager model escalating against a subordinate on its own initiative, not an adversary riding the message channel. The boundary the taxonomy names is still uncovered here
• Standardize the Infrastructure, Not the Tools — the same principle reached from a cost motivation rather than a security one: "the infrastructure governs access, not individual engineers," implemented as a central gateway plus MCP servers on the operator's own auth flow

Open Questions#

• The framework treats every Claude Code "Pro-tip" as a reference implementation. How much of the framework is vendor-neutral vs. tacitly assuming the Anthropic stack?
• "Foundation floor raised" implies a moving baseline. How fast does the tier ladder actually shift, and who arbitrates it (NIST/NSA cadence vs. model-capability cadence)?
• The framework is explicit that it is not legal/compliance assurance. Where does self-attested Zero Trust maturity meet auditable regulatory requirement?

Sources#

• Zero Trust for AI Agents — Anthropic eBook, Zero Trust for AI Agents: A security framework for deploying autonomous AI agents in the enterprise (2026-05-18)
• OpenID Foundation advances authorization for the agent era with new AuthZEN Working Group Drafts — OpenID Foundation, …advances authorization for the agent era with new AuthZEN Working Group Drafts, 15 June 2026, practitioner-opinion (proposed Working Group Drafts, weighted below the empirical per-call-authz systems). Standards-track instantiation of Phase 5 "secure tool access" (COAZ — per-MCP-tool-call authorization) and the Phase 3/5 human-in-the-loop escalation (AARP — prerequisite/approval pattern generalizing CIBA)
• Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions — Huihao Jing + 12 (HKUST / NYU / SWUPL / MODEIO.AI), Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions, arXiv 2607.12406, 2026-07-14, practitioner-opinion. A survey — it measures nothing. Tagged below empirical deliberately: it organizes ~140 prior papers into the five-boundary frame and proposes a research agenda, so it is cited here as vocabulary and structure, never as evidence for any claim about how a system behaves. Sections used: §1 (the taxonomy and the primary-boundary filing rule), §2–6 (one boundary each: threat model, subtopics, defenses), §7.1 (cross-boundary propagation), §7.2 (isolation-by-construction), §7.3 + Limitations (open challenges, and the authors' own caveat that boundary-centric is one valid organization among several). Parse warning — do not cite Table 1. The document's three "tables" are page-break fragments of a single ~140-row annotated bibliography and are pervasively corrupted: wrapped "Main Idea" text bleeds into the following row's cell, consecutive rows merge with Year/Type/Subtopic space-joined (| 2024 2024 | Benchmark Benchmark |), and at least one row's paper label is blank because it fused into its neighbour. The ingest table-collapse/table-shift checks reported clean — a false negative. Every attribution on this page comes from the narrative sections, which describe the same papers correctly; the local PDF () is the fallback for any specific paper's row