AI Agents Are Rewriting the Rules of Zero Trust
AI agents and zero trust are reshaping cybersecurity for Australian organisations. As autonomous AI systems access business applications, retrieve sensitive information, and perform tasks, security teams face new identity and access challenges. Organisations must now verify not only human users but also the AI agents acting on their behalf.
For businesses, the issue goes beyond controlling how employees use generative AI (GenAI). Security teams must now determine how autonomous AI agents access sensitive information, what permissions they receive, and whether their actions comply with organisational policies.
According to Fortinet, this shift requires organisations to rethink how they manage identity, access, and continuous verification. The challenge is no longer limited to identifying the person requesting access. It also involves understanding what an AI agent is doing on that person’s behalf.
Why AI Agents and Zero Trust Must Evolve Together
Traditional zero trust security models focus on verifying users, devices, and their access permissions. However, agentic AI introduces non-human identities that may independently interact with business systems.
Cornelius Mare, Chief Information Security Officer, Australia, Fortinet, said, “Zero trust has traditionally been designed around people and devices. Organisations establish who a user is, what device they are using, what they should be allowed to access, and under what conditions. Agentic AI changes this model because the entity requesting access may now be acting independently on behalf of a person or another system.
“AI agents are zero trust’s newest user. Identity, least privilege, continuous verification, and visibility become even more important. What changes is the scale and context organisations need to understand before deciding whether an interaction should be trusted.”
The challenge becomes clearer when an AI agent performs several actions within a single business process. For example, an employee might ask an agent to analyse information, retrieve a customer record, query another system, and generate an output.
Although the employee makes one request, the agent may initiate several machine-to-machine transactions. Each interaction creates another point where security teams must assess identity, permissions, and access.
As organisations adopt these capabilities, security teams must account for AI agents communicating with other agents and accessing business resources directly.
Australian Cybersecurity Guidance Addresses Agentic AI Risks
Australian cybersecurity authorities have already recognised the security implications of agentic AI.
In May 2026, the Australian Signals Directorate’s Australian Cyber Security Centre, alongside international partners, released guidance for the careful adoption of agentic AI services.
The guidance recommends strict privilege management, continuous monitoring, strong identity management, and human oversight (1). These measures aim to help organisations manage the risks associated with AI systems that can take action.
Organisations reviewing these risks can also examine Cyber News Live’s Agentic AI Security at Runtime Playbook, which explores security controls and governance for AI agents.
However, implementing these controls requires more than verifying an agent’s identity when it first connects. Organisations also need visibility into its ongoing activity and the resources it accesses.
Cornelius Mare said, “The important distinction is between authenticating an identity and understanding what that identity is doing. Knowing that an AI agent is authorised to connect is only the first step. Security teams also need to understand which resources it is trying to reach, the permissions it has, whether its behaviour is expected, and whether the action remains consistent with the organisation’s policy.
“This is where zero trust has to evolve. Trust cannot become permanent simply because an agent was approved when it was created.”
AI Governance Must Extend Beyond Employee Access
Australian organisations also face evolving expectations around AI governance and accountability.
The Australian Government’s Policy for the responsible use of AI in government applies to non-corporate Commonwealth entities. It includes requirements for accountability, internal AI use case registers, impact assessments, and ongoing monitoring (2).
Although these requirements specifically apply to government agencies, they illustrate how AI governance is developing as the technology becomes more capable.
For businesses, the question is no longer simply which AI tools employees can access. Organisations must also determine what AI agents can do after connecting to corporate systems.
This includes identifying which applications and data an agent can access, assigning appropriate privileges, and deciding when human approval is necessary.
Cornelius Mare said, “Organisations need to move from asking, ‘Can this user access this application?’ to also asking, ‘What is acting, on whose behalf is it acting, what is it trying to do, and should it be allowed to do it?’
“Policy has to follow the transaction. An AI agent accessing sensitive information should not receive broad or persistent permissions simply because the employee who initiated the process has that level of access. The agent should receive only the permissions needed for the task, with its activity visible and governed throughout the interaction.”
What Agentic AI Means for SASE and Access Security
The relationship between AI agents and zero trust also raises questions about accountability. Organisations need to know which agent initiated an action, whose authority it operates under, and whether its permissions remain appropriate throughout the task.
The growing use of AI agents also creates challenges for secure access service edge (SASE) strategies.
SASE helps organisations apply consistent security and access controls across users, applications, and environments outside traditional network boundaries. Agentic AI extends these requirements to non-human identities operating within business workflows.
However, organisations should avoid building separate security architectures for every AI agent. Such an approach risks introducing additional complexity and fragmentation into existing security environments.
Instead, businesses need consistent security principles that apply to human and non-human identities while recognising their different risks.
Cornelius Mare said, “SASE sits at the intersection of users, applications, identity, data, and access. As AI agents become part of that traffic, organisations need the ability to identify and govern non-human interactions alongside human ones.
“The question for CISOs is no longer simply whether AI agents will enter the enterprise. It is whether the organisation can identify them, understand what they are doing, and control their access.
Securing AI Agents and Zero Trust Access
Fortinet identifies several immediate priorities for organisations implementing zero trust controls across agentic AI environments.
These include identifying AI agents already operating within business systems, assigning credentials limited to specific tasks, and recording agent activity under each agent’s own identity.
Together, these measures help security teams understand which agents operate within their environments, what they can access, and which actions they perform.
Cornelius Mare said, “For organisations putting zero trust into practice, the immediate priorities are to inventory the AI agents already operating across their environments, give each agent task-scoped credentials rather than inheriting a user’s broader permissions, and log agent actions under the agent’s own identity. These steps help security teams establish visibility, limit access, and maintain accountability as agentic AI adoption grows.
“Zero trust was built on the principle that access should not be assumed to be trusted. This principle becomes even more relevant when the user isn’t human. The next step is applying it consistently to every entity accessing the organisation, whether that entity is an employee, contractor, device, application, or autonomous AI agent.”
As AI agents take on more responsibilities, organisations will need to apply existing security principles to a wider range of identities and transactions. That means verifying access, limiting privileges, monitoring activity, and maintaining accountability throughout each interaction.
The underlying zero trust principle remains unchanged. What is changing is the number and type of entities that organisations must identify, verify, and govern.