Zero Trust Was Built for Humans. AI Agents Need Something Different.
TL;DR: Zero trust is a solid foundation. But it was designed for human users accessing network resources in sessions. AI agents break that model — they don't have sessions in any meaningful sense, their behavior can shift mid-execution, and verifying identity once tells you nothing about what they're doing right now. Agents need continuous behavioral attestation and the ability to force re-verification when risk signals change. We call this Trust Restart.
Zero trust earned its name
Let me be clear about something before I make my argument: zero trust is good architecture. The principle — never trust, always verify — was the right correction to perimeter-based security. NIST SP 800-207 codified it. Google's BeyondCorp proved it at scale. The model works: authenticate every request, validate device posture, enforce least privilege, assume the network is hostile.
I spent years building identity governance systems that eventually adopted zero-trust principles. I am not here to tell you zero trust is wrong. I am here to tell you it was designed for a specific actor — a human being accessing a resource through a session — and that AI agents are a fundamentally different actor.
Where the model breaks
Zero trust verifies identity at the session boundary. A human authenticates, establishes a session, and makes requests within that session. The model assumes that if the identity is verified and the device is trusted, the requests within the session are legitimate. This is a reasonable assumption for humans. Humans have consistent intent within a session. They don't suddenly decide to exfiltrate a database mid-meeting because someone whispered a prompt in their ear.
AI agents break this assumption in four specific ways:
No meaningful sessions. An agent can make thousands of tool calls per minute. It doesn't "log in" and "log out." It operates continuously, and the concept of a session boundary — the unit at which zero trust verifies — doesn't map onto how agents work. You can impose synthetic session boundaries, but they're arbitrary. The agent doesn't know or care that you drew a line at 15 minutes.
Behavioral volatility. An agent's identity doesn't change mid-execution. Its credentials are the same at minute one and minute sixty. But its behavior can change dramatically. Prompt injection can override its instructions. Context window pollution can shift its goals. Goal drift in long-running autonomous loops can push it into actions that no one authorized. Zero trust has no answer for this, because zero trust asks "who are you?" — and the answer hasn't changed. The agent is still itself. It is just doing something entirely different now.
Sub-agent spawning. When a human user opens a new browser tab, zero trust re-evaluates. When an AI agent spawns a sub-agent with delegated credentials, most architectures treat the sub-agent as operating under the parent's trust. The parent authenticated, so the child is trusted. But the child may have different instructions, different context, and different tool access. The trust was never verified — it was inherited.
Cross-boundary operation. Agents routinely operate across trust boundaries that would require separate authentication for human users. An agent with an MCP session might call tools in three different security domains within a single reasoning step. Zero trust was designed for a world where boundary crossings are discrete, visible events. Agents make them invisible.
What agents actually need
If identity verification at the session boundary is insufficient, what do agents need instead? Four things:
Continuous behavioral attestation. Not just "who are you?" but "are you still you?" — evaluated continuously against the agent's actual behavior. If an agent authenticated with a policy that permits reading customer records, and it is now attempting to write those records to an external endpoint, the fact that its identity is verified is irrelevant. The behavior has diverged from the authorized pattern. That divergence needs to be detected and acted on in real time, not at the next session boundary.
Trust Restart. When a risk signal fires — an anomalous tool-call pattern, context window pollution, a privilege escalation attempt, a sub-agent spawning with unexpected scope — the agent's accumulated trust should reset to zero. Not "flag for review." Not "log and continue." Reset. The agent must re-authenticate through the full governance pipeline before it can proceed. This is the mechanism zero trust is missing for agents: the ability to revoke trust mid-execution based on behavioral signals, not just identity signals.
Time-bounded access with automatic expiry. Every grant to an agent should have a wall-clock TTL. Not "until revoked" — until expired. If the agent needs continued access, it requests a renewal, which is evaluated against current policy and current behavior. This bounds the blast radius of any compromise to the time window of the grant.
Blast-radius preview before escalation. Before any privilege escalation is approved, the governance layer should compute and present the combinatorial blast radius — not just the permission being requested, but what that permission enables in combination with everything the agent already holds. A human reviewer (or an automated policy) can then make an informed decision about whether the marginal permission is worth the expanded attack surface.
Trust Restart in practice
Here is what this looks like in SidantiX. An agent is operating under a time-bounded grant, making tool calls that our policy engine evaluates per-call. The behavioral attestation layer is tracking the agent's tool-call patterns against its authorized behavioral envelope.
A risk signal fires. Maybe the agent's tool-call frequency spiked 10x. Maybe it just attempted to access a resource outside its authorized scope. Maybe our prompt injection gate detected adversarial content in the agent's context window.
Trust Restart activates. The agent's current grants are suspended. Its in-flight tool calls are blocked. It must re-authenticate through the governance pipeline — identity verification, policy evaluation, behavioral baseline check — before any further tool calls are permitted. The entire sequence is recorded as a cryptographically signed evidence chain.
Zero trust asks: "who are you?" Trust Restart asks: "are you still you?"
That is the difference between a model designed for humans and a model designed for agents.
Not a replacement — an additional layer
I want to be precise about the claim. Zero trust is the right foundation. You should absolutely verify identity, enforce least privilege, assume hostile networks, validate device posture. Nothing about Trust Restart replaces those principles.
But when the entity you are governing can have its intent hijacked mid-session, can spawn autonomous children, can escalate its own privileges, and operates at a speed where human review is physically impossible — you need a layer that zero trust was never designed to provide. You need continuous behavioral attestation with the ability to reset trust to zero the moment behavior diverges from authorization.
The NIST Zero Trust Architecture and Google BeyondCorp were written for human-to-resource access patterns. They are good documents. They solved the right problem for their era. The agent era needs the next layer.
We are building it.