What does zero trust mean for AI agents?
Updated · DBShifts
Short answer
Zero trust for AI agents means no agent is trusted because of where it runs or what it did before. Every request is checked on its own — identity, permission, data rules — against a default of deny. Tokens are short-lived and scoped, everything the agent reads is treated as hostile, and access can be cut instantly.
Key facts
- Default deny: an agent reaches a table, tool or other agent only when a rule allows it.
- Every request is authorized on its own; an earlier allowed call proves nothing.
- Short-lived, scoped tokens limit what a stolen token is worth.
- The model's output is untrusted, and so is everything the model reads.
- Continuous verification includes re-checking a person's group membership while they use an agent.
In the glossary:Zero trust for AI agents
The principles, applied to agents
Verify explicitly: authenticate the agent and the person it acts for on every request. Least privilege: allow specific tables, columns, tools and agents, nothing by default. Assume breach: treat the agent as already compromised by whatever it last read, and limit what one bad request can do.
Where agents break classic zero trust
Zero trust for people assumes the user means what they do. An agent can be steered by text in a document or a tool result, so a fully authenticated agent can still make a malicious request. Delegation adds another gap: by the third hop, the original user's identity is easy to lose. Both have to be designed for.
Putting it into practice
Put an enforcement point in every path an agent uses — to data, to tools and to other agents — so no request reaches its target without a policy decision. Carry the requester's identity through chains and let rules only tighten along them. Keep a kill switch that takes effect on the next request.
Checklist
- 1
An enforcement point on every path to data, tools and agents
- 2
Deny by default, allow by explicit rule
- 3
Short-lived tokens bound to one resource
- 4
Requester identity carried and verified through chains
- 5
Injection scanning on everything an agent reads
- 6
A kill switch effective on the next request
Common mistakes
Trusting internal agents
An agent inside your network is as easy to steer with planted text as one outside it. Location is not a credential.
Long-lived shared keys
They make every request look the same and turn one leak into lasting access.
How DBShifts does it
- DBShifts Agent Mesh refuses any call no rule allows — even reading another agent's card needs a rule — and rules only get stricter along a chain.
- Chain tokens are valid for 30 minutes and name who started the chain and every agent since.
- DBShifts Agent Gateway checks every request against the token's allowlists and limits, re-checks group membership on each request for people who signed in, and can pause an agent instantly.
Questions people also ask
Is zero trust for AI agents just least privilege?
Least privilege is one part. Zero trust adds verifying every request, short-lived credentials, treating every input as hostile and being able to revoke access immediately.
Does zero trust mean approving every request by hand?
No. Policy decides automatically on every request; people approve only the actions with consequences.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free28 answers in this series. See all or browse the AI agent glossary.