The Agent Access Model: Securing AI Agents with Zero Trust Principles

The Agent Access Model (AAM) extends the principles of BeyondCorp and Zero Trust to a new class of principals: autonomous software agents. Traditional human-centric security models, which rely on user identity, device health, and human-speed interactions, are insufficient for agents that operate at machine speed, are often short-lived, and can compose authority across multiple hops.

Why Human-Centric Models Fail for Agents

• Ephemeral Nature vs. Durable Credentials: Agents are often short-lived tasks, but service account credentials are typically long-lived and broad, leading to credentials outliving their purpose and increasing replay risk.
• Machine Speed vs. Human-Tuned Controls: Anomaly detection and rate limits designed for human activity are too slow for agents, which can exfiltrate data before controls can react. Preventive, inline controls are necessary.
• Prompt-Based Instruction vs. Enforcement: Natural language prompts guide agent behavior but do not enforce access boundaries. Enforcement must occur at the tool call mediation layer and the network layer, not through instructions that can be manipulated.
• Composed Authority: Agents can invoke tools that invoke other agents, making attribution and cumulative authority tracking complex across multiple delegation hops.

Core Principles of the Agent Access Model (AAM)

AAM operates on the core rule: "Do not trust the run. Authorize every action against the task and its accumulated state." This means authorization for one action does not implicitly carry over to the next. Every action is evaluated based on the agent's identity, the specific task it was authorized to perform, and the policy-relevant resources already touched by the task execution graph. The model emphasizes shrinking the agent's capability rather than just making authorization decisions smarter.

1. Credentials are short-lived and bound: Minted specifically for the task and expiring with it, sender-constrained to prevent replay.
2. Enforcement lives in the harness and the network: Policy is applied where tool calls and network requests occur, not merely in the agent's prompt.
3. Human oversight is exceptional: Approvals are reserved for critical decisions, avoiding human fatigue from excessive micro-approvals.
4. Grants are reviewed from evidence: Activity logs inform policy adjustments, which apply to future tasks, never widening active ones.
5. Capability state moves in one direction (Trust Ratchet): When a protected event occurs, capabilities are removed across the task execution graph according to policy, only returning in a newly authorized task.

Reference Architecture Components

• Agent Identity Broker: Issues short-lived, verifiable credentials at task dispatch. These credentials are task-scoped (agent, principal, task) and sender-constrained (bound to a proof key, e.g., using OAuth 2.0 Token Exchange and DPoP).
• Task-Scoped Access Engine: Decides, per request, if an agent's identity can perform an action against a resource for a given task. It extends BeyondCorp's Access Control Engine, making the task a first-class input. Task scopes are declared via templates at dispatch, setting a capability ceiling for the task.
• Mediation Layer (Harness & Network): Enforces policies at the point of action. The harness intercepts tool calls and checks against task policy, while the network boundary forces outbound traffic through governed paths. This ensures policy is applied where execution occurs.