Agentic Zero Trust: organizing trust around AI agents

Source: « Agentic Zero Trust : organiser la confiance autour des agents IA », groupeonepoint.com — French original by Frédérick Miszewski (Onepoint). English version for online publication.

In many organizations, the rules determining who can access which data are scattered across multiple systems. Some live in identity and access management (IAM) solutions. Others are tied to user groups defined in the corporate directory. Access rules also exist inside business applications, in databases through SQL views, and in APIs.

However, the more systems multiply, the harder control and traceability become to manage.

This fragmentation makes it difficult to apply the principle of “least privilege” at scale. be demonstrable.

This principle holds that every user should only have access to the information strictly required to do their job. It also requires that this access be demonstrable.

Policy-as-Code offers an answer to this challenge. The method consists in translating security rules, access rights and governance policies into an explicit, versioned and testable pivot language. Those rules are then rendered into the native language of each target system and deployed automatically.

We shift from implicit, manual governance to policy formalized as code. Those rules are first evaluated by a component that decides whether an access request is authorized (the Policy Decision Point – PDP). They are then concretely applied by enforcement points within the systems, known as Policy Enforcement Points (PEP), which make sure the decisions are respected.

Managing human access to data in a controlled manner is already a challenge in itself. As soon as you cross-reference who accesses what, from which application, in which context, and under which conditions, the number of combinations explodes. It quickly turns into a considerable Cartesian product.

This complexity changes scale with the arrival of AI agents. Action inside the information system is increasingly hybrid: on one side, human actors; on the other, AI agents. The latter already use tools, call APIs, query applications and combine data from multiple sources.

Until now, the questions revolved around the “who,” the “what,” the access rights and the context, all within a logic of least privilege and control. From now on, we must also deal with non-human, autonomous identities, known as Non-Human Identities (NHI). The Cartesian product is bound to grow exponentially.

n this context, Policy-as-Code addresses this growing complexity of access controls once again. It does so as part of a secure agentic architecture foundation. And Agentic Zero Trust provides the trust framework around it.

Its principle is as simple as it is radical. No AI agent is considered legitimate by default, even if it is internal and correctly authenticated. Identity alone is an illusion of control. Every action, every access to a piece of data, must be verified in real time, without waiting for any human validation.

Because we need to know who is entitled to do what. Every action, whether human or applicative, automated or agentic, must also remain under control at every moment.

Toward Agentic Zero Trust

An AI agent tasked with preparing a financial report has access, as part of its mission, to sales data.

Seeking to enrich its analysis, it tries to query the HR database to cross-reference sales performance with individual salaries. The request is technically valid; the agent’s identity is correctly authenticated.

Without Agentic Zero Trust, the agent gets the data. With it, the request is blocked. The action falls outside the perimeter authorized for this purpose. Authentication is not enough.

What matters is the legitimacy of each action in its context. This is exactly the Zero Trust principle applied so far to humans and systems: never trust, always verify. Agentic Zero Trust extends the same requirements to AI agents.

To achieve this, the management of non-human identities (NHI) is a prerequisite. Every agent must be identified, tied to an owner, governed throughout its lifecycle and constrained by the minimization rules that apply.

The risk of regulatory non-compliance will also rise significantly. A necessary but not sufficient prerequisite. An agent may be authenticated and yet still try to access sensitive data, act outside its authorized context or call a lax tool. A tool is an interface made available to an agent so it can query a system, use a business capability or execute an action.

In AI-driven business transformations, agents become operational actors capable of preparing, deciding, executing or triggering. Here again, Agentic Zero Trust is required.

From policy to execution

An agent’s rights, authorized tools, purposes and limits are defined upstream (as “design-time policies”) by drawing on information sources (Policy Information Point, PIP).

Each action is then evaluated by a PDP, enforced at runtime by the PEPs and traced without gaps to ensure auditability. Policy-as-Code makes it possible to formalize, version, test, audit and propagate these rules to the enforcement points.

From governance to rule enforcement: the Policy-as-Code bet inside a mutual insurance company

During a data access governance project carried out at a large mutual insurance company, our teams faced the very real complexity of access management.

The same employee could belong to several groups, hold different responsibilities and access data spread across multiple platforms.

On top of that came varying levels of data sensitivity, restrictions on certain information or on certain data perimeters, and the regulatory requirements specific to some business lines.

Securing the chain of trust with the AI Gateway and data platforms

Within this architecture, it is essential to secure the chain of trust that links the agent’s identity, its actions and the data it manipulates. Security relies on the AI Gateway and the information sources of the IS.

The AI Gateway as a control point

In an agentic architecture, a central control point is needed to supervise the exchanges between AI agents and MCP servers. That is the role of the AI Gateway.

This AI Gateway monitors, among other things, which methods are used. It also checks whether the agent exceeds its authorized quotas toward MCP servers and toward the API calls that expose information sources. It ensures full traceability and feeds observability.

Data-source-side minimization by data platforms

While the AI Gateway monitors the agent’s movements, data platforms provide physical protection as close as possible to the source.

They apply the minimization principle, giving the AI only what is strictly necessary for its mission: masking, filtering, aggregation or exclusion of sensitive information.

Industrializing through a Policy-as-Code approach

Without structuring, the combination of rights profiles, sources, tools and purposes becomes unmanageable.

Industrialization goes through Policy-as-Code: policies defined, versioned and propagated automatically, with full traceability. This model requires a solid governance foundation. This covers classified data, defined sensitivity levels, clarified purposes, and established responsibilities between Data Owners, DPO, security and Application Owners.

Agentic Zero Trust: building an architecture of trust

Building Agentic Zero Trust architectures means guaranteeing that every action of an agent is explicitly authorized, contextualized, limited, controlled at call level (via the AI Gateway), secured as close as possible to the data and audited end-to-end.

The LLM can reason, but it must never decide on its own what it is authorized to do.

In short, deploying an Agentic Zero Trust architecture means building a genuine chain of trust — from the definition of rights to the ability to prove they have been respected.

Summary of the chain of trust

•  Who: rights are defined upstream.
• What: data governance qualifies.
• Who × What: the PDP decides at runtime.
• How: Policy-as-Code industrializes.
• Interactions: the AI Gateway controls agentic exchanges.
• Enforcement: the PEPs apply the rules.
• Verification: observability checks that rules are respected.
• Proof: the audit demonstrates it.

The success of agentic AI will depend, above all, on the ability of enterprises to build an architecture of trust — one that governs identity, data, tools, decisions and actions.

Our conviction: Agentic Zero Trust is the extension of a broader architecture of trust, and Policy-as-Code is its central component.

It formalizes shared rules that apply equally to human and agentic actions, and deploys them to the right control points, so that at every moment an agent’s action remains authorized, limited, observed and provable (PDP + PEP).

To maintain consistent governance despite this complexity, the teams distinguished two essential pieces of information. Who accesses the data, and which data they are trying to access.

The first side, the “who”, describes the user: their job, role, team and the rights granted to them. This information is managed inside identity and access management systems.

The second side, the “what”, describes the data itself: its business domain, its sensitivity level and the uses that are authorized. This information is centralized in the data catalog.

Policy-as-Code then bridges the two worlds. It combines the characteristics of the user with those of the data to determine which access rules should apply. It then automatically translates them for each targeted platform.

This approach delivers consistent, enterprise-wide governance while simplifying operations. Il also offers a unified framework for traceability, audit and control. This is critical when access rules must be demonstrated, explained and verified.

As we noted, this logic applies just as much to human actors as to AI agents. These digital actors must be subject to the same principles of control, traceability and compliance as human employees. A simple analogy helps illustrate the role of the various mechanisms involved. Let’s borrow one from traffic laws.

Rules of the road for AI agents

Policy-as-Code and the PDP play the role of the legislator. They define the rules. These specify who may pass, at what speed, and with what restrictions.

The PEPs are the traffic lights, barriers and signs that enforce the rules at the moment of action.

But as on the road, passing laws is not enough. Indeed, compliance must also be checked. That is where AI observability comes in: at once police officer, radar and black box. It detects abnormal behaviors, traces tool calls, monitors data access and documents incidents.

It is also able to raise real-time alerts or block any traffic that would breach the applicable regulations (GDPR, EU AI Act, etc.).

An analogy with a fundamental principle of quantum physics

What analogy can be drawn with AI agents? Without upstream framing, the actual behavior of an agent is only known after observing its activities.

Heisenberg’s uncertainty principle states that in quantum physics certain properties of a particle cannot be known simultaneously with perfect precision.

Without upstream framing, an AI agent’s behavior is only known after observation. Data & AI Observability covers the monitoring of prompts, the data sources involved, costs, errors and hallucinations. Observing an agent reduces uncertainty about what it has done, but does not guarantee that it was allowed to do it.

This is the very purpose of Agentic Zero Trust: to set upstream the rights, limits, conditions of use and the legitimacy of AI agents.

Agentic Zero Trust frames an agent before it starts moving through the information system. AI and Data Observability provide traceability of what has been executed, along with any deviations from compliance rules (e.g., GDPR, EU AI Act).

Breaking the illusion of LLM-based security

A prompt is not a firewall. Security relies on a technical chain of trust in which every agent request is filtered by an impartial arbiter before being executed.

Handing the LLM the responsibility of not exploiting sensitive data in an inappropriate context is a design flaw. A system prompt can restate a rule, but it does not make it enforceable. A prompt does not block a tool, does not mask a column, does not filter a row, does not stop a dangerous action, and does not constitute audit-grade evidence. It amounts to sticking a Post-it note reading “Do not read” on a confidential file. Nothing guarantees the AI will comply.

The response must be systemic.

To put it differently, security must be external to the AI. For the system to be able to protect data, it must first know what the data contains. That is the role of the Data Office, the custodian of the “what.” It provides the metadata foundation required for end-to-end automation and governance of the Agentic Zero Trust framework.

This foundation relies on a reliable catalog of the data and applications exposed, along with clear sensitivity classifications. It also depends on formalized minimization rules and explicitly defined use purposes.

Rights models must evolve to include the new non-human identities (NHI), the perimeters of delegation, and the authorized tools. They must also account for the permitted purposes and the minimization constraints to be enforced.

Every access must be tied to a precise purpose. This qualification determines the ability of the decision engine (PDP) to rule in real time on the legitimacy of an agent’s request. Such as: “Is this agent authorized to use this tool, for this purpose, on this data and under which conditions?”

The PEP relies on the PDP to deny access when necessary (for example, a prompt asking for the salaries of all employees).