AI Agents Are Becoming Enterprise Insiders. Security Models Need to Catch Up.

Many AI agents now go beyond answering questions or drafting text. Today, they query databases and call APIs across enterprise systems, often without a human in the loop or an approval workflow at each step. AI agents are becoming active participants in business workflows, and many operate with a high degree of autonomy.

This evolution in agentic AI marks a new phase for enterprise security, and many organizations are still working out how to govern that autonomy. The potential for agents to take unintended actions has sharpened the need to secure non-human identities that can act autonomously while holding legitimate access to sensitive applications and data. Attribution is a central part of this challenge: an agent with valid credentials can look much like a trusted insider, yet its behavior may be harder to predict and monitor without the right security controls in place.

Some security providers are examining how established frameworks apply to these problems. Zscaler, a cloud-native cybersecurity platform, is one of them. Its approach pairs Zero Trust principles, which center on verifying identity and limiting implicit trust, with Secure Access Service Edge (SASE), a model that delivers networking and security services together from the cloud. Zscaler refers to this approach as Zero Trust SASE Everywhere. 

The Zero Trust side of this approach rests on three core principles. 

• Verifying explicitly means authenticating and authorizing each request based on all available signals, such as identity, location, device health, workload context, and data classification. 
• Least privilege access limits users and systems to the minimum permissions a specific task requires, often granted just in time. 
• Assuming breach means designing for compromise by segmenting access, encrypting traffic, and monitoring activity continuously to help contain potential impact. 

The SASE side addresses where and how those policies are enforced. 

• Edge-to-cloud convergence brings networking and security functions, such as SD-WAN, Zero Trust Network Access (ZTNA), and secure web gateways, into a single cloud-delivered service. 
• Proximity enforcement places inspection and policy controls close to users, whether they work from home, a branch office, or a mobile device. 
• Identity-driven microsegmentation replaces broad network perimeters with application-specific connections that can help limit lateral movement. 

Zscaler maintains that these principles can provide a foundation for securing agent-driven access, since agents, like human users, need verified identities, tightly scoped permissions, and controls that follow them wherever they operate.

AI Agents Change the Enterprise Identity Landscape

Traditional identity-based security models were designed around a few common categories: human users who log in with credentials, applications that operate on fixed logic, and workloads that execute pre-defined tasks.

AI agents don't fit neatly into any existing identity category. Where a service account is built for one narrow function, an agent often takes on a more dynamic role in the organization. It interprets instructions, selects among multiple possible actions, and interacts with other systems in ways that are not always explicitly scripted in advance.

Governance practices for agentic AI are still developing. In Deloitte's 2026 State of AI in the Enterprise report, which surveyed 3,235 IT and business leaders across 24 countries, 21% of respondents reported having a mature governance model for agentic AI.

The practical difficulty is attribution. Security teams need a clear line back to whoever or whatever an agent is acting for, plus enough insight into its behavior to confirm that each action matches what the task required. An agent can hold valid credentials and still take an unauthorized action well outside the scope of its assignment, which is why legitimate access alone doesn't always translate to trustworthy action.

Applying Least Privilege to Autonomous Access

Agents that inherit a user’s full permission set or receive broad API scopes hold access well beyond what their assigned tasks require. If a credential is compromised or an agent takes an unexpected action, the scope of that access can largely determine how much damage follows. Permissions scoped to the specific task and resource an agent needs at that moment can help limit what any single failure can reach. Broad access granted upfront may be convenient, but it widens that exposure. 

Least privilege also governs how far an agent can move once it's operating, not just which credentials it holds. An agent deployed to run an analytics dashboard has little reason to reach into HR systems or to communicate freely with other agents, since neither falls within its purpose. 

In Zscaler’s view, security models built around known human identities and predictable access patterns may need to evolve to account for agentic AI. Establishing this governance can be especially important before tasks are automated at machine speed and agents begin spawning tasks of their own. Keeping permissions scoped to the task can help prevent that speed from becoming a liability.

Authorization Needs to Account for Context

Verifying an agent's identity at the start of a session only accounts for that moment. An agent authenticated for one task may encounter a new request or begin behaving in an unfamiliar pattern minutes later. A single approval granted at the outset carries little information about that downstream activity and offers a limited basis for evaluating it.

Treating authorization as an ongoing evaluation rather than a single checkpoint can help address this gap. Each request can be assessed against the signals available at that moment: the agent's identity, the action requested, the resource involved, the sensitivity of the data, and the context surrounding the request. This approach aligns with Zero Trust principles, which call for verifying each access request instead of extending trust based on an earlier approval. However, these principles alone don't specify how that continuous evaluation should work for autonomous agents.

How Agent-to-Agent Interactions Affect Trust Boundaries

In many deployments, agents don’t work in isolation. One may delegate a task to another, which in turn calls a third to pull data or trigger an action. Such a chain can span several systems and APIs, and each hop raises the same question: does the receiving agent inherit the permissions of the agent that delegated the task, or is its access scoped independently?

Each hop can benefit from visibility and a clear trust boundary. Without them, an agent's effective permissions can expand as work flows downstream. Attribution erodes the same way. Tracing an outcome or a data exposure back to the agent that initiated the chain can become more difficult as handoffs accumulate.

How Visibility Supports Secure Agent Activity

Security teams can only govern what they can see, and that visibility starts by taking inventory of which agents are operating across the organization. From there, it means knowing what resources each agent accesses, which identity or business process it represents, and what actions it takes once granted access. Many organizations are still building this picture from scratch. Agents can be deployed by individual teams outside formal IT oversight, raising concerns similar to those associated with shadow IT.

Consistent monitoring of agent activity serves several purposes at once. It gives investigators a clearer trail to follow when something goes wrong. It gives policy teams the data to tighten or adjust access rules. And it gives governance teams a record of whether agent behavior has aligned with organizational policy over time.

Extending Zero Trust to the Agentic Enterprise

Securing AI agents can draw on practices many security teams already know well. It starts with verifying an agent’s identity before granting access and keeping its permissions scoped to the task at hand. From there, it involves evaluating context throughout an agent’s activity instead of relying on a single authentication check, keeping sensitive data out of reach when an agent doesn’t need it, and limiting how far an agent can move across applications and systems. Most of these ideas aren’t new. They’re the same principles organizations already apply to users and workloads, adapted for a kind of identity that acts with more autonomy and less predictability.

Zscaler holds that Zero Trust SASE Everywhere principles can provide a foundation for securing AI agents as they become more deeply embedded in enterprise workflows. Applied deliberately, they can help organizations build the access controls and visibility this shift requires, without assuming that an agent, simply because it has been authenticated, should be trusted with everything it touches.