Zero trust security assumes no user or device is trustworthy by default. Now a new kind of actor is appearing on corporate networks: AI agents that read email, call APIs and change records on behalf of people.
Agents need identities too
Treat each agent as a distinct identity with its own credentials, rather than letting it borrow a human's session. That makes its actions auditable and its access revocable.
Least privilege, strictly
Grant agents the minimum permissions for a specific task and time-limit them where possible. An agent that summarises tickets does not need the ability to close them.
Watch for prompt injection
Content an agent reads — a web page, an email, a document — can contain hidden instructions. Separate untrusted content from instructions and require human approval for sensitive actions.
Key takeaways
- Agents need identities too
- Least privilege, strictly
- Watch for prompt injection
