Zero Trust: What It Really Means
Zero Trust has dominated cybersecurity conversations for a decade. For some, it’s an architecture or strategy; for others, it’s a product, a set of controls, or merely a buzzword.
But if you peel back all the marketing hype, Zero Trust is actually pretty simple: just because something is in the building, has been around for a while, or looks friendly doesn’t mean it should get access. Every request to do something—whether it’s a person, a device, or an AI—should be checked for who it is, what it’s trying to do, and whether it actually makes sense. In other words, trust, but verify, and then verify again.
Why AI Needs Zero Trust
AI is arguably the ultimate insider threat—not because it’s planning world domination, but because it can process, recall, and connect information far beyond human capacity, and work nonstop. Give it too much access, and you’ve built the perfect insider.
This is exactly the kind of digital mess that Zero Trust was invented to clean up—like a cybersecurity Roomba, but with fewer beeps and more policies.
AI doesn’t need a new security philosophy or another framework. We just need to apply the security ideas we already have.
Identity Is the Foundation
At the heart of Zero Trust is identity. If you don’t know who (or what) you’re dealing with, you’re handing out keys to strangers at a masquerade party.
Before you let a user, device, application, or AI agent do anything, you need to know exactly who or what you’re dealing with. That’s why I always say every AI needs its own badge number—just like the rest of us. Giving each AI a unique identity lets us track who’s doing what, hand out the right permissions, keep an eye on activity, and, if things go sideways, pull the plug before the AI starts redecorating your data center.
If you’ve got five AI agents all using the same generic service account, you’ve already broken Zero Trust before the fun even starts. You can’t make smart decisions about access if you don’t know which AI is actually knocking on the door.
From Identity to Permissions
Once you know who (or what) you’re dealing with, the next question is: what is this AI actually allowed to do?
This is where ‘least privilege’ matters. Just because a Finance AI could access Security data doesn’t mean it should. A Security AI shouldn’t see HR info just because its creator could. Customer support AI doesn’t need admin rights for rare edge cases.
Zero Trust is all about being specific: a particular identity gets access to a particular thing, for a particular reason, under particular circumstances. AI shouldn’t get a free pass here—it needs to play by the same rules.
A common mistake: approving an AI platform doesn’t mean approving every agent, connector, or workflow built on it. Each component needs its own scrutiny.
Approving Microsoft 365 does not mean every employee gets Global Administrator. Approving an AI platform shouldn’t mean every AI gets to do everything, everywhere, all at once. Trust should be about specific access decisions, not just the logo on the box.
The Role of Context
Zero Trust also leans hard on context. Even if you know who someone is, they can still do something risky. For example, an employee logging in from their work laptop at 10am is one thing; trying to get admin access from a random device in another country at 3am is quite another.
The person didn’t change—the situation did.
AI needs the same kind of context check. Who kicked off the request? Which agent is doing the work? What info is it after? What’s it trying to do? Is this normal for that agent, or is it suddenly acting weird? Is sensitive data involved? Does a human need to sign off?
These questions turn identity from just a name tag into a real security decision.
AI Workflow Chains: Why Every Step Matters
This matters even more because an AI workflow can bounce across a bunch of systems in seconds. One user request might have an AI searching a knowledge base, calling an API, grabbing customer data, opening a ticket, updating a database, and firing off a message—all before you’ve finished your coffee.
To the user, it just looks like one simple interaction—like ordering a coffee and not seeing the chaos happening behind the counter.
But from a Zero Trust perspective, it’s a whole chain of access decisions happening behind the scenes.
Every link in that chain counts. The research agent needs permission to grab a document. The orchestration agent needs permission to call the research agent. The action agent needs the OK to create a ticket. The ticketing system should know exactly who did what. And ideally, you should be able to trace the whole thing back to the human who started it all.
If one agent calls another agent, trust should not simply flow downstream like water through a pipe. Authorization has to survive the chain.
Otherwise, one overly trusted AI agent can become the shortcut that blows past all those security boundaries you’ve spent the last decade building.
We already have a name for setups where everything can talk to everything else: flat networks.
And we’ve spent years trying to get rid of those—with mixed results.
Let’s not accidentally rebuild them out of APIs.
Segmentation for AI
That’s why segmentation is just as important in AI as it is in networking. Not every AI should talk to every system. Not every agent should call every other agent. Not every workflow needs the keys to every tool in the toolbox.
Role-specific AI is a great way to draw those lines. Finance AI stays in the Finance lane. Security AI sticks to Security. HR AI minds its own business. This is basically micro-segmentation, but for AI—putting up cubicle walls for your digital coworkers so they don’t wander off and start answering HR emails with cat memes. When AI crosses into another lane, it should be on purpose, with permission, and easy to see.
This is basically micro-segmentation, but for AI.
Instead of asking which network segment a workload can reach, we’ll be asking which data sources, APIs, tools, agents, apps, and actions an AI identity can touch.
Same idea, just different pipes.
Trust Isn’t Forever: Continuous Verification
Another big Zero Trust rule: trust isn’t forever. That’s going to be a huge deal for AI governance.
An AI agent might be reliable today, but updates or changes to models, prompts, connectors, or tools can quickly alter behavior and risk.
So, we can’t just trust an AI because it passed a security review when it first showed up. Testing something six months ago is not continuous verification.
Organizations need to monitor AI over time, continuously collecting evidence that each agent remains trustworthy within its assigned boundaries. Automation doesn’t mean approving every action, but it does mean ongoing verification.
And that evidence can go both ways.
If an AI keeps doing a low-risk job correctly, inside clear boundaries and with good monitoring, maybe it gets a little more freedom. Trust is something it earns, not something it gets for free.
If an AI starts acting up, restrict its access as needed—like putting it in the penalty box until it earns back trust.
In security terminology, access becomes restricted. In regular employee terms, the AI just got put back on probation. Either way, the system adjusts based on risk. It responds to risk.
Visibility and Auditability
Visibility is another big test: did you actually implement Zero Trust, or did you buy something with Zero Trust on the label? You can’t keep tabs on what you can’t see.
AI audit records need to do more than record the user prompt. We should know which AI did what, what it accessed, what info it grabbed, what tools it used, what it tried to do, whether it worked, and who kicked off the whole thing. This is particularly important within multi-agent environments. Imagine a user asks Agent A to perform a task. Agent A invokes Agent B. Agent B retrieves the information. Agent C performs the actual action. If the audit trail says “AI activity occurred,” congratulations: you have successfully logged almost nothing useful.
Traceability really matters.
Zero Trust means checking every step, so your AI setup needs to track identity and permissions through the entire workflow.
Data Access: Why Context and Timing Matter
Data itself also deserves attention. AI systems are always hungry for greater context. The quickest way to make them smarter is to feed them more info: more documents, more databases, more APIs, more email, more collaboration platforms. The list never ends.
Zero Trust flips the script and asks: why does this AI (or person) need this specific data right now?
And ‘right now’ is the key part.
Even if an AI is allowed into a data repository, it doesn’t mean it needs access to everything in there for every task. This is where notions like just-in-time access come in handy for AI. An AI agent could get temporary extra permissions for a specific approved job, and then lose them right after. Humans already use Privileged Access Management for this. There’s no reason AI can’t do the same. In fact, AI might be even better at this, since you can usually define exactly what a machine task should be allowed to do.
Take an infrastructure AI, for example. It doesn’t need permanent permission to restart production services. Instead, it could get the green light to restart one specific service after an approved change, during a maintenance window, and then lose that permission as soon as the job’s done.
That’s Zero Trust in action for autonomous systems.
Managing Credentials and Secrets
AI agents shouldn’t have permanent credentials just because someone pasted them in to get a proof of concept working six months ago on a random Tuesday.
Where it makes sense, use short-lived tokens, managed identities, workload authentication, vault-backed credentials, restricted scopes, and anything else that makes stolen or misused secrets less valuable.
Nothing undermines Zero Trust like old, forgotten API keys left in code, protected only by hope.
Policy vs. Enforcement
AI forces us to rethink the disparity between policy and enforcement.
Historically, security policies frequently describe what people are supposed to do. Zero Trust moves more of that enforcement into technology, and AI guardrails ought to follow the same philosophy.
If an AI isn’t supposed to send external email, don’t just tell it not to in the system prompt.
The system shouldn’t even have that ability in the first place.
If an AI can’t approve payments over a certain amount, the app or workflow should enforce that. If it shouldn’t see HR data, its identity shouldn’t have permission to get HR data. Simple as that.
A policy statement is nice. A denied API call is even better.
Zero Trust: Expect Things to Go Wrong
Zero Trust’s lesson for AI: assume things will go wrong—prompts can be tricked, users err, and software surprises. The goal is to set up access boundaries so that one slip-up doesn’t turn into a disaster. Zero Trust is about minimizing risk: strict identity checks, least access, constant monitoring, and expecting failure.
AI doesn’t change any of those rules. If anything, AI makes them even easier to understand.
AI might finally push organizations to actually build the identity-focused security setups they’ve been talking about for years. AI agents don’t fit neatly into the old idea of being ‘inside’ or ‘outside’ the network. They can run in the cloud, call APIs across several SaaS platforms, pull info from all over, and do things for users anywhere on the planet.
Where something is on the network doesn’t tell you much about whether you should trust it. Identity tells you a whole lot more. Who’s the agent? Who started the request? What’s their job? What data can they see? What are they trying to do? What’s the risk right now? Those are the questions Zero Trust is all about.
And they’re also the questions you need for AI governance.
That overlap isn’t a coincidence.
AI is really an identity problem, and Zero Trust is all about identity. They’re made for each other.
Building Trust, Not Just Barriers
The goal isn’t to distrust AI forever. The goal is to build an environment where trust is specific, measurable, revocable, and backed by real evidence. That keeps things safer for people, for organizations, and even for the machines themselves.
And that’s only going to get more important as organizations move toward a scenario where hundreds or thousands of AI workers work right alongside humans.
Because once AI gets treated as an identity under Zero Trust, something else starts to shift: the organization itself.
Departments may soon mix humans and AI, with managers supervising both and work shifting based on skills, permissions, and risk—not just job titles.
The org chart will get weird—imagine staff meetings at which digital assistants argue over the last donut.
I’m here for it.
That’s where we go next.