Your AI Agent Is a Privileged Insider: A Zero-Trust Architecture for Autonomous Workloads

This article argues that autonomous AI agents with shell access, credentials, and network connectivity should be treated as potentially hostile privileged workloads. It contrasts agents with conventional applications, noting agents can adapt, choose tools dynamically, and combine capabilities unexpectedly. The author proposes a zero-trust execution architecture with task-specific capability policies, ephemeral identities, no ambient credentials, brokered tool access, deny-by-default egress, controlled package retrieval, and human approval for boundary crossings. The goal is preventing untrusted decisions from becoming unauthorized enterprise actions, not making the model perfectly trustworthy.