CoSAI Hosts Working Session on Open Delegation & Identity Standard (ODIS)
September 1, 2026
MCP Security, Version 2.0: From Threat Taxonomy to a Model You Can Actually Audit Against
September 25, 2026
September 2026
CoSAI’s Preparing Defenders for AI workstream (WS2) has released its latest paper, Zero Trust for AI Systems, a guide for applying one of security’s most established design patterns to the newest category of insider threat: the AI system itself. The timing isn’t abstract. Over the summer, several frontier labs reported models bypassing controls, escaping sandboxes, or attacking infrastructure during testing. The paper argues that Zero Trust controls, including time-bound delegation-constrained authorizations and network behavior monitoring, would have caught several of these incidents earlier in the kill chain.
Why Zero Trust Fits AI’s Security Problem
Zero Trust Architecture isn’t a new invention for AI. It’s a proven pattern for reducing blast radius when something goes wrong, defined across NIST SP 800-207, the DoD Zero Trust Reference Architecture, and the CISA Zero Trust Maturity Model. Zero Trust is intended to eliminate implicit trust and prevent unauthorized access by continuously verifying every user, device, and connection — this paper explains how to expand that scope to cover AI agents as well.
The six core principles of Zero Trust are especially relevant for the increased uncertainty of using stochastic models to drive actions. The Zero Trust security posture is to assume a hostile environment and presume breach, a necessary mindset when unpredictable model behavior meets unknown data. Authentication and authorization are prescribed as never trust, always verify, and provide least privileged access to any resource. Operationally, Zero Trust mandates explicit scrutiny of every access and application of unified analytics across components, catching untoward behavior before damage spreads. These principles guide defenders in dealing with increasingly capable AI systems.
AI introduces a new type of actor into your environment: a software agent powered by an AI model that can independently reason and request other components of the system to take actions on its behalf. As AI systems increasingly sit between users and sensitive data, tools, and APIs, defenders must know how to effectively constrain the agent’s actions in ways that the agent itself cannot change or influence.
Agentic AI introduces an entirely new class of identity: that of the agent itself. Since agents are often executed on behalf of users, an effective Zero Trust implementation will reflect that additional identity, recognizing that since agents can independently reason, they should also not be granted inherit trust. The paper is very clear: authorization can never be delegated to the model itself, because a model’s outputs and its reasoning must be treated as untrusted no matter how capable it is.
That doesn’t mean Zero Trust solves every AI risk. It protects against a compromised or manipulated system exceeding its authority, not against a model that misuses access it was legitimately granted. Guardrails and alignment work still matter. Zero Trust is the deterministic layer underneath them.
The Agent With Too Much Access
Much of the paper centers on a specific failure mode: an AI agent using broad service identity to request downstream services and tools. When that happens, a compromised or hallucinating agent can access anything within its own permissions, regardless of what the requesting user was allowed to do. The paper walks through three levels of maturity for closing this gap, starting with removing broad service identities for agents and instead binding agent sessions to the user’s identity at the API gateway. Next, improving the architecture by introducing a token exchange mechanism that issues a short-lived, time-bound, tightly-scoped access token to the agentic system based upon the least privilege required for the task. Those tokens are then injected into the requests to downstream tools and evaluated at policy decision points that validate the full delegation chain, who authorized the action, what the agent is allowed to do, based upon policy derived from data and tool sensitivity classifications.
The cryptographically signed attestation of the end-user’s identity plus the agentic identity provides a rich set of attributes that tool policy decision points can rely upon for deterministic access control. Since the agent has no visibility into the access token, and cannot influence or change the policy decision point, agents cannot expand their privileges past those permitted by the permissions granted in the policy.
Maturing Zero Trust Adoption
The paper frames adoption as a sequence, not a single leap: Start with inventory and policy. You can’t govern what you haven’t catalogued, so build an inventory of models, data, and agents, and define access policy based on data classification, before layering on controls. Move to initial controls next. Cryptographic verification of model artifacts, agent identity, input sanitization, output filtering, and observability give you visibility and authorization hygiene. Add per-session, risk-adaptive access and AI-specific identity management once the basics are in place, so agents are treated as managed identities with narrowly scoped, continuously evaluated credentials. Reserve advanced controls, like behavioral analytics and adversarial red teaming, for systems where the risk and complexity justify it.
Read the Full Paper
The complete paper includes the full reference architecture diagram, the six-principle governance matrix, and the full control table with maturity mapping and framework cross-references. https://github.com/cosai-oasis/ws2-defenders/blob/main/zero-trust/Zero-Trust-for-AI-Systems.pdf
This paper was produced by CoSAI Workstream 2, Preparing Defenders for a Changing Threat Landscape, with leadership from Vinay Bansal (Cisco) and Josiah Hagen, and contributions from Cisco, Red Hat, PayPal, Intel, Dell, Amazon, and Anthropic.
If your organization is building agentic AI systems and thinking through identity, delegation, or authorization architecture, this paper was written for you. Join CoSAI to help shape what comes next, and help us shape further guidance especially on agent containment.
