AI agents must operate under Zero Trust: verify identities, verify proposed actions, and ensure risk-based control before any tool use, because tool calls carry real-world consequence.

As agents dynamically access tools, implement task-scoped, just-in-time authorization to uphold least privilege and prevent overreach.

Treat prompt injection as a real risk when models can reach systems; design infrastructure assuming manipulation can happen and limit its impact.

Trust in agents should be non-permanent; continuously verify reliability and integrity to guard against manipulation or compromise.

The tool call is the new attack surface, so add an independent evaluation layer to verify identity and policy alignment, and require human input for high-risk actions.

Agents can propose actions, but independent security policies must authorize them, since reasoning alone is not authorization.

Every tool call should be a security checkpoint with dynamic permissions, identity checks, and execution gateways to prevent autonomous overreach.

Three identities matter: the human requester, the specific agent carrying out the action, and the defined permissions (scope, duration, and extent) for that agent.

Zero Trust must extend to AI-driven actions, ensuring auditable, contained, and recoverable systems so missteps can be contained.

An execution gateway between AI and resources enforces identity, policy evaluation, risk scoring, and optional human approval before any API call, with risk varying by action.

Humans should remain skeptical of agent performance; Zero Trust requires ongoing monitoring regardless of past success.