{"id":60686,"date":"2026-06-03T13:09:18","date_gmt":"2026-06-03T13:09:18","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/60686\/"},"modified":"2026-06-03T13:09:18","modified_gmt":"2026-06-03T13:09:18","slug":"extending-zero-trust-across-the-agentic-ai-workflow","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/60686\/","title":{"rendered":"Extending Zero Trust Across the Agentic AI Workflow"},"content":{"rendered":"

Earlier this year, Cisco outlined our vision for\u00a0Zero Trust for the agentic workforce<\/a>. At its\u00a0core\u00a0is a simple\u00a0principle:\u00a0trust should not be\u00a0established\u00a0once and assumed indefinitely.\u00a0As\u00a0agents interact with models, tools, applications, and data, their activity must be continuously evaluated.<\/p>\n

Putting\u00a0that principle into\u00a0practice\u00a0requires controls that can follow agents as they work.\u00a0Consider\u00a0a\u00a0coding agent like Claude Code or Codex.\u00a0To\u00a0complete a single\u00a0task,\u00a0it\u00a0may\u00a0call\u00a0an LLM for reasoning,\u00a0connect\u00a0with\u00a0MCP tools to read Jira and push to GitHub,\u00a0hit\u00a0SaaS APIs for data, and\u00a0browse\u00a0the web for\u00a0additional\u00a0context. It does all this autonomously, at machine speed, carrying whatever credentials it was handed at startup.<\/p>\n

Why existing controls fall short<\/p>\n

Traditional Zero Trust\u00a0controls\u00a0authenticate\u00a0a user and\u00a0grant\u00a0access to a resource.\u00a0Once access is granted, we\u00a0rely on humans to exercise judgment\u00a0or\u00a0machines\u00a0to follow pre-defined rules.\u00a0An agent is neither a user nor a\u00a0deterministic\u00a0machine.\u00a0It is a process that\u00a0reasons, decides, and acts \u2013 with broad scope, exponential scale, and no human judgment.<\/p>\n

As a result,\u00a0access control is no longer enough.\u00a0A coding agent may\u00a0be authorized to\u00a0connect to GitHub, Jira, and an approved set of models.\u00a0The real question is not whether it can connect to those systems, but what actions it takes across them as it works toward a goal. Reading a repository, creating a pull request,\u00a0modifying\u00a0a production configuration, or accessing sensitive data may all carry\u00a0different levels\u00a0of risk.<\/p>\n

This is the shift from access control to action control. Organizations need to evaluate agent activity\u00a0not just\u00a0when\u00a0access is granted, but throughout the workflow itself.\u00a0That\u00a0is the agent security\u00a0challenge\u2014and it is categorically different from the problems Zero Trust was\u00a0originally designed\u00a0to solve.<\/p>\n

From Access Control to Action Control<\/p>\n

Cisco Secure Access is evolving\u00a0to help make that shift\u00a0with\u00a0Agent Gateway\u2014new functionality\u00a0that extends policy enforcement across\u00a0agent interaction with\u00a0LLMs, MCP servers, SaaS APIs,\u00a0and\u00a0web destinations. To move from access control to action control,\u00a0Agent Gateway\u00a0will\u00a0help\u00a0answer\u00a0five questions before a request is\u00a0allowed\u00a0to\u00a0proceed:<\/p>\n

Who is the agent?\u00a0Cisco uses Duo to\u00a0identify\u00a0the Codex, Claude Code, or\u00a0LangChain\u00a0agent itself \u2013 not just the laptop it runs on.<\/p>\n

What is it trying to\u00a0access?\u00a0Agent Gateway\u00a0will\u00a0map\u00a0requests\u00a0to a named resource group: an approved model set, a group of MCP tools, a set of SaaS APIs, or a web category.<\/p>\n

Is this action allowed?\u00a0Policy\u00a0will\u00a0decide whether the request is\u00a0permitted,\u00a0observed, or blocked. A \u201cfetch\u201d from the GitHub repo is allowed; a \u201ccreate_file\u201d to the same repo can be denied.<\/p>\n

Which credential should be used?\u00a0Tokens, OAuth grants, and API keys\u00a0will\u00a0live in Cisco\u2019s vault. The agent never touches them.\u00a0Agent Gateway\u00a0will\u00a0inject the right credential server-side per method and path.<\/p>\n

What happened?\u00a0Every decision \u2013 agent identity, resource touched, policy verdict, credential reference, route taken\u2014will\u00a0land in one audit event.<\/p>\n

\"CiscoFigure: Cisco\u00a0Secure Access Agent\u00a0Gateway\u00a0applies consistent policy across agent interactions<\/p>\n

What makes Cisco\u2019s approach different<\/p>\n

Many approaches to agent security\u00a0introduce\u00a0a second access stack\u00a0that\u00a0enterprises adopt alongside their existing SSE and identity infrastructure. Cisco\u2019s\u00a0approach\u00a0is different: if you already run Secure Client, Secure Access, and Duo, you already have the enforcement surface.\u00a0With Agent Gateway,\u00a0Cisco extends these\u00a0capabilities\u00a0into\u00a0the\u00a0agentic\u00a0workflow.\u00a0No agent code changes. No new\u00a0management\u00a0portal. No second identity system.<\/p>\n

Agent identity via Duo\u00a0Non-Human Identity (NHI).\u00a0Duo\u00a0will\u00a0identify\u00a0the agent\u00a0process itself\u00a0using Duo\u00a0identity,\u00a0extending\u00a0naturally from user MFA to\u00a0agent and non-human identities.\u00a0No separate identity service\u00a0required.\u00a0In MCP environments,\u00a0Duo\u00a0and Secure Access work together to enable fine-grained\u00a0tool-level\u00a0authorization,\u00a0so\u00a0organizations\u00a0can\u00a0govern\u00a0which tools an agent is allowed to invoke,\u00a0not just which MCP servers an agent can access.<\/p>\n

Shared policy across the workflow.\u00a0Agents\u00a0operate\u00a0across\u00a0models, MCP tools, APIs, and web activity\u2014not\u00a0within\u00a0a single\u00a0control plane.\u00a0With Agent Gateway,\u00a0Cisco\u00a0will\u00a0apply\u00a0a common policy framework across\u00a0those\u00a0environments, helping organizations\u00a0govern approved models, MCP tools, enterprise APIs, and web destinations.<\/p>\n

Server-side credential injection.\u00a0Keys and tokens live in Cisco\u2019s vault.\u00a0The agent never touches them.\u00a0Agent Gateway\u00a0will\u00a0inject the right credential\u00a0server-side\u00a0per method and path.\u00a0This separates\u00a0agent\u00a0authorization from credential possession,\u00a0allowing agents to\u00a0perform\u00a0approved\u00a0actions\u00a0without access to the underlying credentials.\u00a0This\u00a0closes\u00a0a class of exfiltration risk that no proxy-only solution\u00a0addresses.<\/p>\n

What this means in practice<\/p>\n

Consider an\u00a0enterprise deploying\u00a0hundreds of\u00a0coding agents\u00a0across software development.\u00a0Each agent may\u00a0be authorized to\u00a0use approved LLMs, access Jira through MCP tools, retrieve source code from GitHub, consult internal documentation, and interact with selected enterprise APIs. On paper, that sounds straightforward. In practice, those agents may perform thousands of actions every day across dozens of systems.<\/p>\n

Traditional access controls can answer whether an agent is allowed to connect to GitHub.\u00a0They\u00a0struggle\u00a0to\u00a0show\u00a0whether a particular action\u00a0was\u00a0appropriate once\u00a0the agent\u00a0got\u00a0there.\u00a0Even\u00a0basic audit questions require stitching evidence from LLM provider logs, MCP server logs, GitHub audit trails, and whatever the agent\u2019s orchestration framework happens to capture.<\/p>\n

With\u00a0Agent Gateway\u00a0and\u00a0Duo, every agent has a named identity\u00a0tied to its owner and business purpose.\u00a0Every GitHub interaction shows which method was called, whether it was allowed, and which vault reference\u00a0provided\u00a0the token. When a model provider has an outage,\u00a0requests can automatically\u00a0fail over\u00a0to\u00a0another\u00a0approved model\u00a0within\u00a0the\u00a0same policy\u00a0framework. Observation mode\u00a0can\u00a0identify\u00a0unusual patterns\u2014such as\u00a0a burst of write requests to a normally read-only\u00a0API\u2014and\u00a0surface\u00a0them as policy recommendations.<\/p>\n

The value is not another dashboard. It is\u00a0a single\u00a0control loop for agent identity, action, credential, policy, and\u00a0outcome.<\/p>\n

Some products or features described may be in various stages of development and offered on a when-and-if available basis.\u00a0Cisco reserves the right to change delivery timelines and will have no liability for any delays or failures to deliver.<\/p>\n

We\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/p>\n

Cisco Security Social Media<\/p>\n

LinkedIn<\/a>
Facebook<\/a>
Instagram<\/a><\/p>\n

\t