Zero Trust for AI Agents: Permissions, Approvals and Audit Trails

We spent five years building cyber-security products before AI agents existed: privileged access, Zero Trust, endpoint protection. So when companies ask us how much access to give their first AI agent, our answer is always the same. As little as possible, and less than you think.

An agent that only reads is a search tool. An agent that can refund a customer, email your whole list or change a contract is something else. Treat it like a new employee on day one: useful, eager, and not yet trusted with the keys.

The four rules

1. Least privilege

Give each agent only the data and actions it needs. A support agent may read orders, but it should not export your customer list.

2. Human approval for risky actions

Refunds above a threshold, messages to many customers and changes to contracts should wait for a person to approve them, in the tools your team already uses.

3. A full audit trail

Record who asked, which agent acted, what it did and what changed. When something goes wrong, you need to know exactly what happened. Auditors and investors will ask.

4. Assume prompt injection

Emails, tickets and web pages can contain hidden instructions written for AI. Treat every piece of content an agent reads as untrusted, and block actions that don't match the user's request.

Questions to ask before you deploy an agent

• What is the worst thing this agent could do with its current access?
• Which actions need a person's approval?
• Can we see every action it took last week?
• How do we switch it off instantly?

Why it matters now

Agents are moving from experiments to production. The companies that set these rules early can give agents more responsibility safely. The ones that don't end up either blocking agents entirely or learning from an incident.