Agentic Zero Trust: Organizing Trust Around AI Agents

In many organizations, the rules determining who can access which data are distributed across multiple systems. Some are found in identity and access management solutions. Others are associated with user groups defined in the organization’s directory. Access rules also exist within business applications, databases through SQL views, and APIs.

However, as the number of systems grows, control and traceability become increasingly difficult. This fragmentation makes it harder to apply the principle of least privilege at scale. This principle ensures that each user can access only the information they need and that the organization can demonstrate that this is the case.

Policy-as-Code provides a response to this challenge. This method consists of translating security, access rights, and governance rules into explicit, version-controlled, and testable policies using a common language. These rules are then translated into the language of the source system and deployed automatically.

Implicit and manually managed rules are replaced with rules formalized as code. These rules are first evaluated by a component that determines whether access should be authorized, known as the Policy Decision Point, or PDP. They are then enforced within the systems by Policy Enforcement Points, or PEPs, which apply those decisions.

Managing human access to data in a controlled manner is already a significant challenge. Once organizations account for who is accessing what, from which application, in which context, and under which conditions, the number of possible combinations creates a considerable Cartesian product.

This complexity reaches a new scale with the introduction of AI agents. Activity within the information system is becoming increasingly hybrid. Human actors operate on one side, while AI agents operate on the other. These agents already use tools, call APIs, query applications, and combine data from multiple sources.

Until now, access control questions focused on the “who,” the “what,” access rights, and context, based on the principles of least privilege and control. Organizations must now also account for autonomous non-human identities, or NHIs. The resulting Cartesian product can therefore be expected to grow exponentially.

In this context, Policy-as-Code, as part of a secure agentic architecture foundation, provides a response to the increasing complexity of access controls. Agentic Zero Trust provides the corresponding trust framework.

Its principle is both simple and radical. No AI agent is considered legitimate by default, even if it is internal and properly authenticated. Identity alone creates only an illusion of control. Every action and every data access request must be verified in real time, without waiting for human validation.

Organizations need to know who is authorized to do what. Every human, application-based, automated, or agentic action must remain under control at all times.

Toward Agentic Zero Trust

An AI agent tasked with preparing a financial report has access to sales data as part of its assigned mission.

To enrich its analysis, it attempts to query the HR database and cross-reference sales performance with individual salaries. The request is technically valid, and the agent’s identity has been properly authenticated.

Without Agentic Zero Trust, the agent obtains the data. With Agentic Zero Trust, the request is blocked because the action falls outside the authorized scope for that purpose. Authentication alone is not sufficient.

What matters is the legitimacy of each action within its specific context. This is the core principle of Zero Trust, which has traditionally been applied to humans and systems: never trust, always verify. Agentic Zero Trust extends these same requirements to AI agents.

Managing non-human identities is therefore a prerequisite. Each agent must be identified, assigned to an owner, governed throughout its lifecycle, and restricted according to applicable data minimization rules.

The risk of regulatory noncompliance will also increase significantly. Identity management is necessary, but it is not sufficient. An agent may be authenticated and still attempt to access sensitive data, act outside an authorized context, or call a poorly secured tool. A tool is an interface made available to an agent so that it can query information, use a business capability, or execute an action.

As AI transforms business operations, agents become operational actors capable of preparing, deciding, executing, or triggering actions. Agentic Zero Trust is also necessary in these situations.

From policy to execution

An agent’s rights, authorized tools, permitted purposes, and limitations are defined in advance through design-time policies, using information sources known as Policy Information Points, or PIPs.

Each action is evaluated by a PDP, governed during execution by PEPs, and continuously logged to ensure auditability. Policy-as-Code makes it possible to formalize, version, test, audit, and distribute these rules to the relevant enforcement points.

From governance to rule enforcement: applying Policy-as-Code in a mutual insurance company

During a data access governance project for a large mutual insurance company, our teams encountered the real-world complexity of access management.

A single employee could belong to several groups, hold different responsibilities, and access data distributed across multiple platforms.

This variety of use cases was compounded by different levels of data sensitivity, restrictions applying to certain information or data domains, and regulatory requirements specific to certain business functions.

Securing the chain of trust through the AI Gateway and databases

Within this architecture, organizations must secure the chain of trust connecting the agent’s identity, its actions, and the data it handles. Security relies on the AI Gateway and the information sources within the information system.

The AI Gateway as a control point

An agentic architecture requires a central control point responsible for supervising interactions between AI agents and MCP servers. This is the role of the AI Gateway.

The AI Gateway monitors, among other things, which methods an agent uses and whether it exceeds the authorized quotas for MCP servers and API calls exposing information sources. It provides complete traceability and supports observability.

Minimization at the source through data platforms

While the AI Gateway monitors the agent’s activity, data platforms provide protection as close to the source as possible.

They apply the principle of data minimization, which consists of giving the AI only what is strictly necessary to complete its mission. This may involve masking, filtering, aggregating, or excluding sensitive information.

Industrializing controls through Policy-as-Code

Without a structured approach, the combination of access profiles, sources, tools, and purposes becomes unmanageable.

Industrialization relies on Policy-as-Code: policies are defined, version-controlled, and propagated automatically, with complete traceability. This model requires a strong governance foundation, including classified data, defined sensitivity levels, clearly established purposes, and responsibilities assigned among Data Owners, the Data Protection Officer, security teams, and Application Owners.

Building an architecture of trust

Building Agentic Zero Trust architectures means ensuring that every action taken by an agent is explicitly authorized, contextualized, restricted, controlled at the call level through the AI Gateway, secured as close to the data as possible, and audited from end to end.

The LLM may reason, but it must never decide on its own what it is authorized to do.

Deploying an Agentic Zero Trust architecture therefore requires building a genuine chain of trust, from the definition of access rights to the ability to demonstrate that those rights have been respected.

Summary of the chain of trust

• Who: Rights are defined in advance
• What: Data governance classifies the data
• Who × What: The PDP makes the decision at runtime
• How: Policy-as-Code industrializes the rules
• Interactions: The AI Gateway controls agentic exchanges
• Rule enforcement: PEPs enforce the rules
• Verification: Observability monitors compliance with the rules
• Proof: Auditing provides evidence

The success of agentic AI will depend primarily on the ability of organizations to build an architecture of trust that governs identities, data, tools, decisions, and actions.

We believe that Agentic Zero Trust is an extension of a broader architecture of trust, with Policy-as-Code as its central component.

Policy-as-Code formalizes shared rules that apply to both human and agentic actions. It then deploys those rules to the appropriate control points to ensure that, at every moment, an agent’s action remains authorized, restricted, observable, and verifiable through the PDP and PEP.

To maintain consistent governance despite this complexity, the teams distinguished between two essential types of information: who is accessing the data and which data they are attempting to access.

The first dimension, the “who,” describes the user, including their occupation, role, team, and assigned rights. This information is managed within identity and access management systems.

The second dimension, the “what,” describes the data itself, including its business domain, sensitivity level, and authorized uses. This information is centralized in the data catalog.

Policy-as-Code then connects these two dimensions. It combines the characteristics of the user and the data to determine which access rules should apply. It then automatically translates those rules for the various platforms involved.

This approach provides consistent governance across the organization while simplifying operations. It also creates a unified framework for traceability, auditing, and control, which is essential when access rules must be demonstrated, explained, and verified.

As discussed above, this logic applies to both human actors and AI agents. These digital actors must be subject to the same principles of control, traceability, and compliance as human employees. A simple analogy helps illustrate the role of the different mechanisms involved: the rules of the road.

Code of conduct for AI agents

Policy-as-Code and the PDP play the role of the legislature. They define the rules, including who may proceed, at what speed, and under which restrictions.

PEPs act as traffic lights, barriers, and road signs that enforce the rule at the moment an action is performed.

However, as on the road, defining laws is not enough. Compliance must also be verified. This is where AI observability comes into play, acting simultaneously as a police officer, speed camera, and black box. It detects abnormal behavior, traces tool calls, monitors data access, and documents incidents.

It can also issue real-time alerts or block activity that violates applicable regulations, including the GDPR and the EU AI Act.

An analogy with a fundamental principle of quantum physics

How does this relate to AI agents? Without a predefined framework, the actual behavior of an agent becomes known only after its activity has been observed.

The Heisenberg uncertainty principle states that, in quantum physics, certain properties of a particle cannot be known simultaneously with perfect precision.

Similarly, without a predefined framework, the behavior of an AI agent becomes known only after observation. Data and AI observability covers the monitoring of prompts, data sources, costs, errors, and hallucinations. Observing an agent reduces uncertainty about what it has done, but it does not establish what the agent was authorized to do. Agentic Zero Trust addresses this issue by defining the agent’s rights, limitations, conditions of use, and legitimacy in advance.

Agentic Zero Trust governs an agent before it begins moving through the information system. AI and data observability provide traceability regarding what was executed and any potential deviations from compliance requirements, such as the GDPR or the EU AI Act.

Agentic Zero Trust: moving beyond the illusion of LLM security

A prompt is not a firewall. Security relies on a technical chain of trust in which every agent request is filtered by an impartial decision mechanism before it is executed.

Assigning responsibility to the LLM for avoiding the inappropriate use of sensitive data is a design flaw. A system prompt may restate a rule, but it does not make that rule enforceable. A prompt cannot block a tool, mask a column, filter a row, stop a dangerous action, or provide audit evidence. It is comparable to placing a sticky note on a confidential file marked “Do not read.” Nothing guarantees that the AI will follow the instruction.

The response must be systemic.

In other words, security must exist outside the AI. Before a system can protect data, it must understand what that data contains. This is the responsibility of the Data Office, which governs the “what.” It provides the metadata foundation required for end-to-end automation and governance within the Agentic Zero Trust framework.

This foundation relies on a reliable catalog of exposed data and applications, clear sensitivity classifications, formalized minimization rules, and explicitly defined purposes of use.

Access models must evolve to incorporate new non-human identities, delegation scopes, authorized tools, permitted purposes, and the minimization constraints that must be enforced.

Every access request must be tied to a specific purpose. This qualification determines whether the decision engine, or PDP, can assess the legitimacy of an agent request in real time. The question may be framed as follows: “Is this agent authorized to use this tool for this purpose, on this data, and under these conditions?”

The PEP relies on the PDP to deny access when necessary, for example when a prompt requests the salaries of all employees.

---

Would you like to move beyond manually managed access controls and build an industrialized chain of trust that can secure the AI agents of the future?

Our experts help you turn your data catalog, the “What,” and IAM, the “Who,” into the two pillars of an industrialized, auditable chain of trust.

Data access governance

• Assess the scope of data access
• Design and refine access profiles to deploy Zero Trust at scale
• Define access rules across the data estate for both humans and AI agents

Data catalog optimization

• Assess the completeness of the data catalog to support Policy-as-Code and define PDP rules

Rule industrialization

• Define the target architecture for AI Zero Trust and/or Agentic Zero Trust

Data and AI observability

• Understand the downstream requirements of Zero Trust and how observability complements the approach

Education and alignment

• Establish and share the target vision
• Prepare for secure agentic AI