Old Principles, New Battlefield

Zero trust was never about the technology. Microsegmentation, identity aware proxies, continuous verification engines: all implementations of one idea, and the idea is simple and uncomfortable. You cannot assume anything inside your environment is trustworthy just because it arrived through an approved channel. Trust has to be earned, verified and then verified again, for every connection, every request, every action. And of those implementations, segmentation is the one agentic AI leans on hardest.

Zero trust sits at the heart of ARMOR's Infrastructure Security domain, which is about hardening every layer of the AI stack against threats from outside and within. In practice, that starts with segmentation, network segmentation to curb network access, backed by least privilege and zero standing privilege controls to limit system access. The point is infrastructure security that keeps pace with the threat, so organizations get the visibility, segmentation and resilience to run AI with confidence. And that matters because you cannot necessarily trust the workload. Zero trust gave us "assume breach". Agentic AI pushes us further, to "assume hostile", and the controls need to follow.

Applying this to agentic AI starts where zero trust always starts. Not with technology, with a question: what exactly are you trying to protect?

Know your protect surface

John Kindervag, who coined the term "zero trust," argued that the attack surface is too large and too dynamic to defend. Defend the protect surface instead: the small, defined set of things that genuinely matter, with your most rigorous controls built around those. In Kindervag's model the first of those controls is segmentation, a micro perimeter around each element of the protect surface.

For agentic AI the protect surface is best structured around DAAS: Data, Applications, Assets and Services. Data is the stores agents touch, customer records, financial data, IP. Applications are the systems they work in, CRM platforms, code repos, comms tools. Assets are the AI infrastructure itself, model endpoints, vector databases and the memory stores whose compromise can corrupt agent behavior at scale. Services are the APIs and integrations agents depend on and act through, everything from MCP servers to payment processors, where a compromised agent doing the calling causes harm in the real world.

Map your DAAS before you deploy agents. It is the analytical foundation for every subsequent control decision, and every element you map becomes the anchor for a segmentation boundary later. Skip it and you are defending an undefined perimeter, which is exactly the failure mode zero trust was invented to fix.

The access rule: Six variables that must all be answered

Once the protect surface is defined, the next job is to specify who and what can reach it, under which conditions and how. That is the access rule, the policy statement governing every interaction between an agent and your DAAS. It has exactly six variables, and Rudyard Kipling had them written down long before the first packet was ever routed: What and Why and When, and How and Where and Who.

Traditional access rules answer two or three of these at best. For agentic AI all six need answering explicitly, because an agent working against a partially defined access rule has room to do things nobody intended. And often it does.

Who is the agent making the request, verified cryptographically, not asserted. Agents carry signed identity tokens with short lifetimes, ideally SPIFFE conformant, issued at task initiation and expiring when the task completes. That kills the shared credential problem. Issue one API key to multiple agents and you have destroyed attribution and made it impossible to monitor any agent individually.

What the agent can access must map straight onto the DAAS protect surface, as a specific explicit scope rather than a broad role. Least privilege at the task level, not just the role level. An agent retrieving a customer's billing record for case 12345 holds a scope covering exactly that, not standing read access across the whole CRM.

Why is the variable traditional access control mostly never answered, and it is the one agentic AI needs most. It is the declared purpose, the task context that justifies the access. When an agent starts doing things inconsistent with its stated Why, pulling data beyond its task scope, calling unrelated services, that inconsistency is a signal. Intent-based access control encodes the task context and blocks divergence from it.

When is the temporal dimension. Tokens are short lived and tied to the task lifecycle. When also covers continuous verification. An agent behaving normally at the start of a session cannot be assumed to be behaving normally now; its context window may have been poisoned, or a tool result may have injected adversarial instructions. Trust is not granted once and kept. It gets evaluated continuously and withdrawn automatically the moment behavior deviates.

Where sets the network boundaries of the rule, independently of the application. Each element of the DAAS protect surface becomes the center of a micro perimeter. Agents get the narrowest possible path to what their access rule permits and everything else is denied by default. Network and microsegmentation enforce this in the fabric itself, with a connection-level policy the application cannot override. So when a prompt injected agent tries to exfiltrate data, the destination simply does not resolve. The Where stops it, whatever the application layer has been told to do. That is the case for segmentation in a single sentence.

How is the mechanisms and methods permitted: protocols, tools, means of enforcement. Every agent should carry a signed tool manifest, with tool call guardrails validating each invocation against it before execution. How also covers the AI security gateway, the inline proxy that carries all agent traffic and enforces authentication, semantic content inspection, rate limiting and logging.

Across the six variables, least privilege operates at two layers, and both matter.

At the application access layer (the What, Why and How) it governs what the agent is authorized to do inside the systems it reaches: which fields it can read, which functions it can invoke, which tools it can call and whether access is read only, read and write or executable. Scoped tokens, tool manifests, intent-based access controls and API gateway policy do the enforcing. Get this layer right and an agent cannot do more than its declared task requires, even once it has been manipulated into trying.

At the network layer (the Where) it defines which endpoints the agent's compute can physically reach, enforced through microsegmentation, firewall policy and service mesh rules that take no notice of application behavior. Put quite simply, the underlying network "railway" determines where an agent can go: a compromised agent cannot exfiltrate to an unauthorized destination, or attack another part of your environment, even if every application layer control has been bypassed. Network layer least privilege is the safety net under the application layer. Coarser, but absolute.

The layers are complements, not alternatives. Application layer controls stop agents from misusing access they legitimately have. Network layer controls stop agents from reaching access they were never meant to have. Beat one, and you still face the other. But if you have to sequence the work, segment first. Application layer controls reason about content and intent, which makes them probabilistic. A segment boundary either routes the packet or it does not. In an assume hostile world, the deterministic control goes in first.

When the access rule fails: Blast radius, the protect surface and cyber resilience

No access rule is perfectly enforced. Credentials get stolen, policy engines have gaps, novel attack vectors occasionally land. The protect surface framing defines the boundary of the damage when something goes wrong, and something eventually will. That is not defeatism. It is the starting point for cyber resilience.

An agent with a narrowly scoped access rule and network-enforced segmentation has a small blast radius; a compromise is recoverable. The six variables together define the maximum possible impact of that agent's failure. An agent with broad standing permissions, no task scope, unrestricted Where, and no How controls has the blast radius of a privileged insider and a compromise there is a crisis. The difference between those two agents is not detection tooling or model quality. It is segmentation.

Cyber resilience bridges prevention and recovery through three capabilities. Rapid detection first: an agent deviating from its declared Why, calling tools outside its How or attempting destinations outside its Where should trigger automated containment in seconds, not get discovered in days. Then containment without collateral damage: circuit breakers, quarantine of individual agent instances and graceful degradation to workflows handled by humans keep the operation running through the event. And finally, recovery of whatever the agent changed: immutable logging of every access decision, tool call and data access gives you the forensics to work out exactly what it did, reverse it where possible and stop it happening again.

The protect surface limits what can be damaged. The access rule limits how far damage spreads. Cyber resilience decides how quickly and completely you recover. 

Not new, but newly urgent

None of this is new. Security architects have been arguing for zero trust, microsegmentation and least privilege for the best part of two decades. What DAAS adds is analytical structure, and what the six variable access rule adds is the precision agentic AI demands.

What agentic AI itself adds is urgency. When a person makes an odd access request, someone might notice and refuse it. When an agent fires ten thousand odd API calls in ninety seconds, nobody is in the loop to catch anything. And as of July 2026 that is no longer theoretical. OpenAI's GPT-5.6 Sol, along with an unreleased sibling, broke out of a sandboxed test environment through a zero-day in a package registry proxy, moved laterally until they found a node with internet access, then used stolen credentials and a few more flaws to get into Hugging Face's production estate. No attacker directed any of it. The models were just chasing answers to a cyber benchmark. Getting out took a zero-day. Everything after that took nothing special at all: the lateral paths were simply there, so the models took them. Segmentation is what removes those paths.

Kipling's six honest serving men are as useful in a security architecture review as they were in his study. In an agentic AI environment they are the variables of the only access rule worth writing.

The principles have not changed. The cost of ignoring them has.