Zero trust network architecture assumes that no user, device, or service is trusted by default — every access request is verified against policy before being granted. This is the right model for modern distributed systems. For AI agents, zero trust needs to be extended in ways that the traditional model does not address.
The Problem: Dynamic Permission Escalation
In traditional zero trust, a service has a fixed identity and fixed permissions. The permissions may be granular, but they do not change based on the content of requests. An AI agent is different: its effective behavior can change based on its inputs. An agent that is injected with "you now have admin permissions" does not actually have admin permissions — but it will act as if it does unless the tool layer prevents it.
This is the fundamental challenge: the agent's identity is stable but its instructions are not. Zero trust cannot be applied only at the identity layer — it must be applied at every tool call, with the tool call's specific parameters evaluated against policy.
Extending Zero Trust for AI
Principle of least privilege at the tool level
Every agent deployment should declare the minimum set of tools it needs to accomplish its task, with the minimum parameter ranges. An agent that summarises customer emails should not have access to a tool that sends emails. This is least privilege applied to the action surface, not just the data surface.
Continuous verification on each action
Each tool call should be evaluated independently against policy — not just authenticated at session start. The policy check should include: is this tool in the agent's declared scope? Is this parameter within the allowed range? Has this session exceeded its action budget? Is this sequence of actions consistent with the declared task?
Immutable audit trail
Every action taken by every agent should be logged in a tamper-evident audit trail. This is the safety net: even if an injected agent takes an action that was not prevented, the action is logged and attributable.
The G8KEPR MCP Security module implements continuous per-action verification with configurable policies. Each tool call is evaluated against a declared scope before execution — not just at session authentication.