I have been prototyping a zero-trust identity model for AI agents for about two months. The question: how do you give an agent access to what it legitimately needs without exposing what it should not see?
The architectural principles are not new — information silos, opaque identifiers, field-level encryption — but applying them to agent systems surfaces specific design choices that matter.
Opaque identifiers prevent cross-context reasoning. If agent A refers to a customer as cust_7a3f and agent B refers to the same customer as cx_b91d, neither agent can correlate information across boundaries unless a trusted broker authorizes the correlation. Information silos enforced at the identifier layer are stronger than silos enforced at the access-control layer, because there is nothing to join on.
Field-level encryption beats row-level access control. Row-level access control protects against unauthorized row reads. It does not protect against an authorized agent that leaks the row content downstream. Field-level encryption ensures an agent can only decrypt the fields it specifically has keys for, even if it can read the whole row.
Audit everything, especially the boring stuff. The interesting attacks on agent systems are usually boring: an agent has been given wider access than it needs, and something inside the agent\\u2019s logic exploits that. Comprehensive audit logs — every request, every field accessed, every tool called — are the only way to reconstruct what went wrong after the fact.
Still early in the work. What I can say so far: this is one of the areas where standard web-security patterns need adaptation for AI, not just adoption. The threat model is different because the actor is non-deterministic.
Leave a Reply