Zero Trust Meets AI Agents: Treat Them Like Employees, Not API Keys

In my last post I argued that AI quietly shifted from models that answer to systems that act. This one digs into the messiest consequence of that shift: when software can move money, sign things, and touch production systems, who exactly is it, and why should anything trust it?

The security industry spent 2026 scrambling to answer that question. Here’s where things stand.

The numbers behind the panic

Start with the gap between reality and practice. According to Okta’s research, 88% of organizations report suspected or confirmed AI agent security incidents. Yet only 22% treat agents as independent, identity-bearing entities, and barely a third apply the same security controls to agents that they apply to human employees.

Meanwhile the population exploded. Machine identities already outnumber humans roughly 50 to 1 in traditional environments, and closer to 500 to 1 in microservice-heavy stacks. The Cloud Security Alliance estimates that around 99% of these non-human identities hold more permissions than they need. Every autonomous agent you deploy joins that crowd, except this one reads untrusted content and makes its own decisions.

So the incidents were not hypothetical. This year alone we saw a CVSS 10.0 command injection in Gemini CLI, an API key exfiltration path in Claude Code, and a Terraform MCP Server bug where one user’s token could serve another user’s requests. All fixed, but the pattern is clear.

The reframe: identity is a signal, not a credential

Zero Trust has always said “never trust, always verify.” The agent era changes what “verify” means.

The old model checked a credential once at login and trusted the session afterward. That dies with agents, for two reasons. First, AI made identity easy to fake: deepfakes and injection attacks defeat the checks we used to rely on. Second, an agent that was perfectly legitimate at 9:00 can be manipulated by a poisoned document at 9:05.

The CSA’s framing captures it well: identity is no longer a credential to be checked, it is a continuous signal to be interrogated. In practice that means watching behavioral telemetry such as API call sequences and acting the moment a session drifts from its pattern, not waiting for the next login.

What the identity giants actually shipped

The major IAM platforms spent the year turning agents into directory citizens.

Microsoft made Entra Agent ID generally available. Every agent gets its own identity, and crucially, every agent requires a named human sponsor who owns its lifecycle. No sponsor, no agent, no orphans. Agents run through the same Conditional Access engine as humans, with least-privilege and just-in-time access, and risky agents can be blocked outright.

Okta announced a full “secure agentic enterprise” blueprint built around three questions: where are your agents (shadow-agent discovery, agents registered in Universal Directory), what can they connect to (an Agent Gateway with credential vaulting and rotation), and what can they do (automated access reviews, audit trails, and Universal Logout for AI Agents, which is essentially a kill switch that revokes an agent’s tokens everywhere). Agent SSO went live in August, replacing static API keys with short-lived, governed tokens. Auth0’s “Auth for MCP” followed the same path.

Different vendors, same playbook:

The emerging pattern: a named human owner, a real identity, ephemeral credentials, continuous evaluation, and a way to pull the plug instantly.

The standards quietly converged

This is the part most people missed, because it happened in working groups rather than keynotes.

The Model Context Protocol’s authorization layer is built on OAuth 2.1 with PKCE, and requires Resource Indicators (RFC 8707) so a token stolen from one server can’t be replayed against another. Then in August 2026, Okta’s Cross App Access extension, which lets an agent’s identity and delegation chain travel across applications, was adopted as MCP’s official Enterprise-Managed Authorization extension. That single move turned agent delegation from a proprietary feature into a cross-vendor pattern.

Elsewhere, the Agent2Agent protocol landed at the Linux Foundation with signed Agent Cards and support for OAuth, OIDC, and mutual TLS. SPIFFE is being adapted to give agent workloads automatically rotating, revocable identities. NIST launched a dedicated AI Agent Standards Initiative in February and published a concept paper on the genuinely hard problem: multi-hop delegation, because OIDC and SAML were never designed to express “the user delegated to agent A, which delegated to agent B, which called agent C.” An IETF draft layers W3C Decentralized Identifiers and Verifiable Credentials on top so that parties with no prior relationship can still evaluate an agent’s authority. OWASP shipped a Top 10 for Agentic Applications, and Singapore’s cybersecurity agency went as far as recommending trusted agent registries and mandatory human verification for high-impact actions.

For a space that barely existed eighteen months ago, that’s remarkable convergence.

What’s still broken

Three problems keep showing up, and none of them are solved by better protocols.

Prompt injection defeats identity. A perfectly authenticated, perfectly scoped agent that reads a poisoned GitHub issue still executes the attacker’s intent with the agent’s legitimate credentials. The industry consensus is that this is architectural: you can’t patch your way out of a system where data and instructions share a channel. Identity tells you who acted. It can’t tell you who’s really steering.

Delegation inherits the widest permission. When agents chain, the whole chain tends to inherit the broadest access anywhere in it unless someone actively narrows scope at each hop. Least privilege dies quietly, three hops in.

Governance lags protocol. The protocol layer turned out to be the easier problem. Where deployments actually fail is the boring stuff: agents with no owner, credentials that never expire, delegation chains nobody logs, access reviews that never happen. The spec exists. The discipline doesn’t yet.

The takeaway

The industry’s answer to agent identity has crystallized into one principle: treat agents like employees, not API keys. Give them a real identity with a named human sponsor. Hand them short-lived credentials scoped to one task. Review their access like you’d review a contractor’s. Watch what they do continuously, and keep a kill switch within reach.

The protocols to do all of this now exist and are converging fast. The two things they can’t fix are an attacker whispering through the agent’s own inputs, and organizations that register agents in the directory and then never look at them again. In 2026, the technology stopped being the bottleneck. The discipline is.

---

Sources: CSA: Identity in the Age of AI, CSA Labs: Agentic Identity Standards and Guidance, Microsoft: Four priorities for identity security in 2026, Okta: Blueprint for the secure agentic enterprise, Start with Identity: Agent identity gets a protocol, CSA Labs: AI Agent Identity Crisis