Home | Intelligent Enterprise | The Future of Data Security for AI | Strong Agent Identity Is Only the Beginning: Bringing Zero Trust Authorization to Agentic AI
The rapid emergence of agentic AI is changing the way organizations think about identity, access, and authorization.
In a recent NIST Cybersecurity Insights blog, “Back to the Future: Why Agentic AI Needs a Strong Identity Foundation,” NIST highlights an important reality: many of the security challenges emerging with AI agents are not entirely new. Credential sharing, long-lived credentials, overly broad permissions, local accounts, and excessive reliance on human approval have challenged identity and access management for decades. Agentic AI simply magnifies those challenges because software agents can operate at a speed and scale far beyond human users.
NIST’s message is straightforward and important: agents need to be treated as first-class entities with their own identities, credentials, and associated entitlements. Organizations should build on established identity and authorization practices rather than repeat the mistakes of the past.
We agree, but there is an important next step.
Knowing the identity of an AI agent does not, by itself, determine what the agent is authorized to do.”
As enterprises move from AI assistants that answer questions to autonomous agents that retrieve information, invoke APIs, modify records, execute transactions, and collaborate with other agents, authorization must become dynamic, contextual, and data centric.
Identity establishes "who" authorization determines "what"
Traditional access control often starts with a relatively simple question:
Who is requesting access?
For agentic AI, that question remains essential. But it is only one part of the authorization decision. An enterprise may know that an AI agent is acting on behalf of an employee, application, or business process. It still needs to determine:
- What is the agent trying to access?
- What action is it attempting to perform?
- Why is it performing that action?
- What business process is it supporting?
- What data is involved?
- How sensitive is that data?
- What organization, project, geography, or customer does the data relate to?
- What is the current context?
- Has the agent been delegated authority for this particular action?
- Does that authority remain valid as the agent moves between applications, tools, and data sources?
This is where dynamic authorization becomes particularly important. NextLabs defines dynamic authorization as the ability to evaluate access rights in real time based on the attributes of the subject, resource, environment, and requested action. Rather than assuming that an identity’s permissions remain valid after an initial authentication event, authorization can be reevaluated at the time each resource is accessed.
For agentic AI, this distinction becomes critical. An agent may begin a workflow with legitimate authority to access a particular set of information. During execution, however, it may call another service, access another application, retrieve additional data, or delegate work to another agent. The authorization decision therefore cannot simply be made once at the beginning of the workflow.
The authorization context must travel with the operation and be evaluated whenever the agent attempts to access sensitive resources.
From agent identity to agent authority
Consider an AI agent supporting an engineer investigating a manufacturing problem.
The engineer may be authorized to access product documentation, engineering drawings, manufacturing data, and certain customer information. But that does not necessarily mean the AI agent should have unrestricted access to everything the engineer can access.
The organization may establish policies such as:
- The agent may access engineering data associated with the engineer’s assigned programs.
- Export-controlled data may only be accessed when the appropriate user, project, location, and regulatory attributes are present.
- Customer information may be used for analysis but not exported.
- Sensitive engineering drawings may be viewed but not downloaded.
- Certain records may be returned only in masked or redacted form.
- The agent may read data from one system but may not modify the source system.
- Access may be permitted during a defined workflow but denied outside that business context.
These are not simply identity questions. They are policy questions involving identity, data, action, context, and business purposes.
This is the fundamental value of Attribute-Based Access Control (ABAC) and policy-based authorization. Instead of encoding every possible permission into a static role, organizations can express policies that evaluate multiple attributes dynamically. NextLabs’ CloudAz provides centralized policy management and a dynamic authorization policy engine for precisely this type of real-time, attribute-driven access control.
The agent should not inherit unlimited human authority
One of the most important observations in the NIST article is the danger of giving agents local user accounts or allowing them to operate using a person’s credentials and entitlements. Doing so can allow an agent to impersonate a user and operate with access that may be much broader than necessary. NIST also warns that relying excessively on human-in-the-loop approvals can create consent fatigue.
The alternative is not necessarily to put a human in front of every agent’s action. Instead, organizations can establish policy-based boundaries around delegated authority.
For example:
An AI agent operating on behalf of an engineer may access engineering documents classified as Internal or Confidential for projects assigned to that engineer but may not access Export Controlled documents unless the required authorization attributes are present.
The policy can then be evaluated automatically whenever the agent requests access.
This allows the organization to distinguish between:
Identity:
Who is the agent, and on whose behalf is it operating?
Authority:
What actions has the organization authorized the agent to perform?
Context:
Under what circumstances is that authority valid?
Resource:
What specific application, record, document, dataset, or API is being accessed?
Action:
What is the agent attempting to do?
That distinction is essential for Zero Trust.
Zero Trust must extend to AI agents and data
Zero Trust Architecture is based on the principle that access should not be implicitly trusted simply because a user, device, workload, or application has previously been authenticated. The same principle should apply to AI agents.
NextLabs’ Zero Trust Data-Centric Security approach applies dynamic authorization and real-time policy enforcement to applications and data, allowing organizations to evaluate access at the point where sensitive resources are actually being used.
This creates a useful architecture for agentic AI:
Agent Identity → Policy Evaluation → Dynamic Authorization → Data-Centric Enforcement
The agent first establishes its identity and delegated relationship to a human, application, or business process. A policy engine then evaluates the request using relevant identity, resource, action, and environmental attributes. The resulting decision is enforced at the application or data layer.
This is particularly important because an AI agent may interact with many different systems during a single workflow. A policy should not disappear simply because the agent moves from an API to a database, from a database to a business application, or from an application to a cloud data store. The same organizational security policies should follow the data and remain enforceable across the enterprise.
The importance of an attribute foundation
This also highlights why the attributes used to make authorization decisions matter so much. Agentic environments can draw context from identity systems, applications, data classification systems, organizational directories, business systems, device information, and other sources. Without a consistent way to collect and normalize those attributes, policy decisions can become fragmented across individual applications.
NextLabs’ CloudAz Meta Attribute Store is designed to address this challenge. The Meta Attribute Store functions as an enterprise Policy Information Point (PIP), centralizing, normalizing, and enriching subject and resource attributes from multiple systems of record. This provides a consistent attribute foundation for scalable ABAC and Zero Trust authorization.
For agentic AI, this can become particularly valuable. An authorization policy might need to understand not only that an agent is acting for a particular employee, but also:
- the employee’s department
- the employee’s role
- the agent’s purpose
- the application or workflow invoking the agent
- the classification of the requested data
- the customer’s identity
- the geographic location
- the regulatory restrictions associated with the data
- the current transaction or business process
A centralized attribute foundation makes it possible to bring those signals together for a consistent authorization decision.
Authorization needs to happen where the data is
There is another important implication of agentic AI: securing the agent itself is not enough. An agent can be compromised, misconfigured, manipulated, or simply make an unexpected decision. Even a properly authenticated agent may make a request that should not be permitted. That means the enterprise should not rely solely on controls surrounding the AI model or agent at runtime.
The data itself needs protection.
NextLabs’ Zero Trust Data-Centric Security portfolio combines centralized policy management with enforcement technologies that protect data within applications, databases, cloud services, and files. The portfolio includes CloudAz, Application Enforcer, Data Access Enforcer, and SkyDRM. This creates defense in depth for agentic workflows.
For example, if an agent is authorized to retrieve information from a database, policies can determine which records it can access. If sensitive fields should not be exposed, dynamic masking or filtering can be applied. If the agent retrieves a protected document, persistent protection can continue to govern how that document is used and shared.
The result is a security model that does not assume that the agent will always behave exactly as expected. Instead, authorization and data protection provide boundaries around what the agent can actually accomplish.
Dynamic authorization is particularly important at machine speed
Human users typically perform a relatively limited number of transactions during a workday. AI agents can potentially execute thousands or millions of operations across applications and data sources.
That changes the economics of authorization. Manual provisioning and periodic reviews are difficult enough for human users. They become even less practical when software agents can create large numbers of access requests and dynamically navigate complex workflows.
This is why authorization decisions need to be:
- Real-time, so access can be evaluated when it is needed;
- Fine-grained, so policies can govern individual resources and actions;
- Context-aware, so authorization reflects current circumstances;
- Centralized, so organizational policies remain consistent;
- Externalized, so authorization policies can evolve without rewriting applications;
- Auditable, so organizations can understand what agents accessed and why.
CloudAz is designed around these principles. Its centralized policy platform enables organizations to manage ABAC policies separately from protected applications and dynamically enforce those policies at runtime.
Moving beyond "allow or deny"
Agentic AI also challenges the traditional binary view of authorization. In many circumstances, the right answer is not simply “allow” or “deny.” An organization may want to allow an agent to access data but restrict what it can see.
For example:
- Allow: The agent can retrieve the customer record.
- Filter: The agent can retrieve only records associated with the customer’s business unit.
- Mask: Sensitive fields such as personal identifiers are concealed.
- Restrict action: The agent can read the information but cannot modify or delete it.
- Persistent protection: A document retrieved by the agent remains protected when it is subsequently shared.
These capabilities are particularly relevant for AI because the security objective is often to enable an agent to accomplish a business task without giving it unrestricted visibility into enterprise information. NextLabs’ data-centric enforcement technologies support controls such as data filtering, masking, and persistent protection alongside dynamic authorization.
Agentic AI makes Zero Trust authorization more important, not less
The NIST article concludes that established IAM standards and best practices provide the foundation for secure and scalable agentic protocols. We agree with that direction. But as organizations move toward increasingly autonomous AI systems, the security architecture needs to extend beyond authentication.
Strong identity tells us who or what is making a request. Zero Trust authorization determines whether that request should be permitted under the circumstances. Data-centric enforcement ensures that the policy decision is actually applied to the resource being protected. Together, these capabilities provide a foundation for governing AI agents without unnecessarily limiting their ability to automate business processes.
The future of enterprise AI will not be defined simply by how intelligent an agent becomes. It will also depend on whether organizations can confidently give that agent access to the information and systems it needs while maintaining control over what it can see, what it can do, and under what conditions it can do it.
That requires treating AI agents as identities. But it also requires treating authorization as a continuous, dynamic decision rather than a one-time permission. For enterprises preparing for an agentic future, that is the next step in Zero Trust.
Building a Zero Trust Foundation for Agentic AI
NextLabs helps organizations extend Zero Trust principles to applications, data, and AI-enabled workflows through dynamic authorization, ABAC, centralized policy management, and data-centric enforcement.
With NextLabs’ Zero Trust policy platform CloudAz, organizations can centrally define and dynamically evaluate policies based on identity, data, action, and context. CloudAz’s enterprise class Meta Attribute Store provides a centralized foundation for the attributes required to make those decisions and its robust Dynamic Authorization policy engine evaluates those policies at the time of the data access request. NextLabs enforcement technologies then apply data security controls across applications, databases, cloud services, and files.
As agentic AI moves from experimentation into enterprise operations, this combination can help organizations move from simply knowing what an agent is to controlling what that agent is allowed to do.
