Agentic AI Security: From Zero Trust to Zero Assumption
Zero Trust taught enterprises not to trust identities.
Agentic AI demands something harder.
Not simply verifying identities, but continuously validating autonomous decisions.
This is the next architectural shift in enterprise security. The identity may already be verified. The infrastructure may already be secure. The credentials may already be valid. What remains uncertain is what an autonomous system decides to do next.
That uncertainty is the new security perimeter.
Zero Trust Verifies the Caller. It Can’t Verify the Choice.
Zero Trust fundamentally changed enterprise security by removing implicit trust from users, devices, and workloads. Every request is authenticated, every identity is verified, and every resource is protected before access is granted. This model has served organizations remarkably well because traditional software follows a predictable execution path: an API receives a request, executes predefined business logic, and returns a response. Security focuses on verifying the caller and controlling access to the requested resource.
Agentic AI changes that assumption. An authenticated agent can reason, adapt, choose different execution paths, invoke tools, collaborate with other agents, and make decisions based on changing context. Its next action is no longer predetermined—it is produced at runtime.
Authentication answers who is making the request. Authorization determines what that identity may access. Neither answers the question that now matters most:
Should this autonomous system perform this action, in this sequence, under these circumstances?
Zero Trust evaluates requests. Agentic systems execute plans. No single authorization check can evaluate the plan itself.
That is the gap Zero Assumption is designed to close.
Security is no longer evaluating whether an authenticated identity may access a resource. It is evaluating whether an autonomous system should continue executing the plan it has created.
Security Is Still Thinking in APIs. Agents Think in Goals.
Traditional enterprise applications are built around predefined functions. An API performs a specific operation, and workflows follow deterministic sequences that architects can reason about in advance. Enterprise security has evolved around protecting those predictable execution paths.
Agentic systems operate differently. They begin with an objective rather than a predefined sequence of steps, and the path they take may vary every time they execute. An agent may retrieve information from multiple systems, invoke external tools, collaborate with another agent, revise its plan after discovering new information, or terminate a workflow altogether. Those decisions are not hardcoded—they emerge dynamically at runtime.
This fundamentally changes what enterprise security must protect. The challenge is no longer securing a fixed execution path. It is governing a dynamic decision process.
The Security Perimeter Has Moved
Every major technology shift has expanded the enterprise security boundary. Cloud computing extended it beyond the data center. Containers shifted the focus to workloads, while APIs introduced a new layer of service-level security. Agentic AI represents the next evolution, where the security perimeter is no longer defined by infrastructure or interfaces, but by autonomous workflows.
Consider a customer support agent operating within an enterprise. The agent authenticates successfully, has permission to access customer records, consult the internal knowledge base, coordinate with the billing system, issue refunds below an approved threshold, and schedule follow-up activities. Every permission has been granted deliberately, every authorization check succeeds, and every individual action appears legitimate when viewed independently.
The problem emerges when those individually valid actions are combined into an autonomous execution plan. A carefully crafted support request could influence the agent to retrieve customer information, coordinate with another agent, issue a refund just below the approval threshold, and modify the follow-up workflow to suppress further review. From the perspective of traditional security controls, nothing appears unusual because every action was individually authorized.
The damage is in the combination.
Security verified each individual step. It never evaluated the autonomous decision-making process that connected them.
The new security perimeter is therefore no longer the application or the API. It is the autonomous workflow itself.
Introducing Zero Assumption
I believe autonomous systems require a new security principle. I call it Zero Assumption—an extension of Zero Trust where trust is no longer granted solely to identities, but continuously earned by every autonomous decision.
Zero Trust assumes that no identity should be trusted by default. Zero Assumption extends that principle to autonomous behavior. An authenticated agent is not automatically an authorized decision-maker. Every significant action should be evaluated against its context, permissions, business policies, operational constraints, and intended outcome before it is allowed to execute.
The unit of trust has changed. In traditional systems it was the caller. In agentic systems it is the decision.
Designing an Agent Security Layer
Most enterprise AI architectures already include familiar building blocks such as foundation models, retrieval systems, vector databases, tool orchestration, evaluation frameworks, and observability. As autonomous systems become more capable, they will require another architectural layer: Agent Security.
This is not another security appliance or another compliance checklist. It is a runtime capability responsible for governing autonomous behavior.
An Agent Security layer answers questions that existing security controls cannot answer completely. Which tools can this agent invoke? Under what conditions may it access sensitive data? When should human approval be required? Can it delegate work to another agent? Can every autonomous decision be reconstructed after execution?
These are no longer operational concerns. They are architectural requirements.
Five Capabilities That Will Define Agent Security
I believe mature Agent Security platforms will converge around five foundational capabilities.
Agent Identity establishes a unique, verifiable identity for every autonomous agent rather than relying on shared service accounts or generic API keys. Once identity is established, Fine-Grained Authorization applies least-privilege principles to capabilities instead of entire systems, ensuring an agent receives only the permissions required to complete a specific task.
Authorization alone, however, is insufficient. Runtime Governance continuously evaluates autonomous actions against business policies, approval workflows, operational limits, and compliance requirements because whether an action should proceed often depends on context that exists only during execution.
Governance without visibility is simply faith. Agent Observability provides transparency into which tools were invoked, which permissions were exercised, why decisions were made, and how multiple agents collaborated throughout a workflow.
Finally, Agent Forensics reconstructs the complete execution history—including retrieved context, memory state, tool invocations, delegated tasks, policy evaluations, and decision lineage—enabling incident response, compliance investigations, and continuous improvement.
Together, these capabilities govern autonomous decision-making rather than simply protecting infrastructure.
Lean Agents Are More Secure Agents
One lesson I’ve learned through my work on Lean Agentic AI is that efficiency and security are closely related. A lean agent has a smaller decision surface: fewer tools to govern, fewer permissions to reason about, fewer delegation paths to validate, and fewer memory states to secure. In the language of Zero Assumption, that simply means fewer assumptions to earn.
Every unnecessary tool expands the attack surface. Excessive permissions increase operational risk. Uncontrolled delegation makes behavior more difficult to understand, while persistent memory introduces additional governance responsibilities. Architectural simplicity therefore improves more than efficiency—it strengthens security, observability, and auditability.
The next generation of AI systems will not be distinguished by how many tools they can use. They will be distinguished by how precisely those tools are governed.
Zero Trust changed enterprise security by making identity the unit of trust.
Agentic AI changes the unit of trust once again—from identity to decision.
Authentication will always matter. Authorization will always matter. But neither is sufficient when software can independently plan, reason, and act.
I believe the next evolution in enterprise security is not about replacing Zero Trust. It is about extending it.
From Zero Trust to Zero Assumption—where every autonomous decision must continuously earn trust before it is allowed to execute.
If you found this article valuable, subscribe to Technology Bytes. Each edition explores the intersection of Agentic AI, software architecture, cloud, sustainability, and enterprise innovation—sharing practical insights, original frameworks, and thought leadership to help leaders build AI systems that are not only intelligent, but also efficient, responsible, and scalable.