Zero Trust for AI agents: Containing the agentic endpoint

Compromise is temporary by design: the cell is replaced, not repaired. Tasks A and C never notice. 

In his recent post, "The agentic endpoint," Amit Singh laid out where the device is headed. Soon every laptop and phone we manage will run dozens of AI agents, and most of them will carry the identity, permissions, and network access of the person they work for. Compromise one device and you get every agent, credential, and session on it. That’s the agentic endpoint, the last mile of enterprise AI security. Amit gave us a four-part framework for it: discover, decide, contain, prove.

This post goes deeper on contain, the hardest of the four. It’s where Zero Trust has to change the most, because the model most of us run today was built for a different kind of actor.

Where classic Zero Trust breaks

Zero Trust, as NIST SP 800-207 lays it out, assumes a human session. You authenticate at the door, authorize each resource, and re-check every so often. Agents break three of those assumptions:

• Behavior is predictable. Not with agents. The same agent with the same permissions can take a different path every time it runs.
• Intent is stable. Not anymore. An email, a webpage, or a PDF can rewrite what an agent is trying to do halfway through a task.
• Humans set the pace. Not even close. Agents work at machine speed, so a control loop that runs in minutes is already too slow.

The riskiest agents have what security folks call the "lethal trifecta": They read untrusted input, they can reach sensitive data, and they’re allowed to act across systems. Here’s what that costs under the classic and the agentic Zero Trust models. 

Illustrative scenario. An agent acting for an employee is asked to summarize a shared document. 

Verify the actor, constrain the environment

Zero Trust for agents has two halves. The first is verifying the actor: who the person is, which agent is acting, and what only the endpoint can see. Those combine into a risk score for every task. The second is constraining the environment. Every task runs inside boundaries that limit the damage if that score turns out to be wrong. Verification tells you how much to trust an agent. Containment makes sure a bad call costs you one task, not one device.

The unit of containment is the execution cell, the bounded environment a single agent task runs in. Every task gets one. Risk decides how strong the boundary is and where it runs. Everyday work runs on the managed device, browser agents run in a managed browser session, and high-risk work runs in an isolated virtual environment, which shares no process, file, or network space with the device. Placement follows risk, so you don’t pay for the strongest isolation everywhere.

In summary, you can’t constrain what you haven’t discovered. You decide boundaries and credentials before an agent acts. Every decision leaves a record you can replay.

These principles are how “Zero Trust for agents” gets done.

Six principles

Each one shuts down a different path an attacker, or a misbehaving agent, could take.

Each principle and the threat it neutralizes.

None of this requires starting over. Enterprises already run the foundations: endpoint management, identity, virtualization, and telemetry built over a decade. The work is extending them to a new kind of actor. Some of these capabilities are available today, and some are still emerging, and isolation differs by platform: Windows is building agent isolation into the OS, while macOS relies on isolated virtual environments.

Containment that moves with risk

When risk goes up, the response should too, and it should be automatic, proportionate, and reversible. A good response costs a person seconds, not a day. If containment keeps blocking justified work, that’s a design failure.

Each step reverses as risk drops. Organizations set the thresholds and automation limits, from report-only to wipe.

Where to start

Zero Trust for agents isn’t rip-and-replace. It takes a foundation you already run and extends it to a new kind of actor. Here are six questions to see what’s already true for you:

If you checked two or fewer, start with discovery. You can’t contain what you can’t see. If it’s three or four, close the gaps in boundaries and privilege next. If it’s five or six, put your effort into proof and automation at agent speed.

Whoever controls the endpoint controls every agent on it. Zero Trust is how you keep that control without saying no to AI.