Thought Leadership

I spent years as an engineer before I ran a company, and I still remember the drudgery of access pathways. Log on to a VPN, request a token from a vault, wait for approval, then finally get access to the production database that I needed to update. Every developer I knew could speak to shortcuts they leveraged: an SSH key that never expired, a credential hardcoded in a script, whatever allowed them to get the job done faster. The engineering habit of routing around access pathway friction is about to accelerate in significance as a security problem. This is because now it's not developers using shortcuts. It's their AI agents.

For two decades, Zero Trust principles have done a good job of improving security posture: Verify explicitly, grant the minimum privilege required, and assume you've already been breached. These three principles replaced trust in the network perimeter with explicit verification at the point of access. But they were designed around assumptions about how humans and machines behave. Humans are slow, curious, and occasionally irrational. Machines are fast, narrow, and boringly predictable. AI agents are neither. They act at machine speed while behaving non-deterministically and autonomously, and these characteristics create failure modes that do not occur for humans and machines.

For example, an individual agent can make autonomous decisions that are within the scope of its assigned privileges and still contribute to a collective deleterious outcome. Picture a swarm of agents, each individually authorized to optimize database queries across a cluster. No agent talks to another, and none exceeds its scope. But they can all converge on the same fix at once, one that saturates I/O and degrades the cluster. Nothing here is anomalous, so there is no alert elevating the collective decision for review. Zero Trust, as originally written, has no answer for this collective failure mode.

This is why we laid out these core principles to advance Zero Trust to Agent Trust:

• “Enforce Continuously” extends “Verify Explicitly”: every agent gets a unique cryptographic identity anchored to a hardware root of trust, and it runs inside a trusted runtime that constrains what it can architecturally reach, not just what policy defines.

• “Bound Collective Autonomy” extends “Use Least Privilege”: actions that are safe individually but dangerous in aggregate get escalated for decision review before they execute, not after.

• “Assume Misalignment” extends “Assume Breach”: agents drift, sometimes because someone's manipulating them, sometimes just from context shift over a long session, and you need to catch that drift in real time rather than reconstruct it after the damage is done.

Agent Trust depends on an important identity foundation: humans, machines, and agents need to all be first-class actors that interact with each other in a unified identity layer. They cannot operate in fragmented identity systems that are reconciled through observability and governance. Further, it is critical to eliminate the static credentials and static privileges that enable inappropriate lateral movement between systems. You don’t protect a credential by rotating it faster. You eliminate it. You enforce privileges by bounding them continuously in the runtime. No static credentials. No static privileges.

The data backs up the urgency of investing in these foundational principles. Teleport’s 2026 Infrastructure Identity Survey found 70% of organizations grant AI systems more access than a human doing the same job would receive, and those running over-privileged agents experience 4.5x more security incidents than those applying least privilege. Only 3% have automated controls to govern AI systems as they run. That gap won't close on its own, and agents aren't waiting around for enterprises to catch up.