Zero-trust, applied to AI agents

Zero-trust earned its place in networking because implicit trust kept turning into lateral movement. The principle is simple: never assume, always verify, scope to the minimum. Agents reintroduce exactly the problem zero-trust solved - implicit trust, now at the tool boundary.

An agent with a generous tool registry is an insider with standing access to everything. The fix is the same one networking landed on: deny by default, grant explicitly, scope to purpose, and revoke when the purpose ends. The difference is that the unit of access is a tool call, evaluated at runtime against policy.

Applied well, this is invisible to the happy path and decisive on the dangerous one. A support agent reads orders and searches the knowledge base; the moment it reaches for a payments tool it was never scoped to, the request is denied and recorded - no exception, no drift.