Identity verification was always a proxy for intent. With human users, recognisable behavioural patterns made an imperfect proxy workable. AI agents holding persistent tokens break that model: the failure is structural, and it does not sit inside any single product.
The architecture assumed a human at the keyboard
Zero Trust has become the dominant framing for enterprise security in following the collapse of the perimeter model. The logic was sound. If the corporate network boundary could no longer be relied on to separate trusted from untrusted actors, then every access request had to be verified regardless of origin. The practical implementation followed: multi-factor authentication, device posture checks, conditional access policies, least-privilege provisioning.
The architecture worked because it was designed around a specific kind of actor. A human user logs in once per session, operates within a recognisable behavioural pattern, and moves at human speed. When something deviates: access from an unusual location, a large data export at an unusual hour, a login at 3am, the anomaly is detectable because the baseline is well understood.
Agentic AI breaks that baseline. An agent operating inside an enterprise environment does not log in once. It holds a persistent token, potentially with broad scope, that it uses to execute a sequence of automated tasks across multiple systems. The initial authentication event is clean. The downstream action chain may bear no resemblance to the purpose for which access was originally granted—and the controls designed to catch anomalous behaviour have no reliable way to tell the difference (Abnormal AI, 2025).
This is not a newly discovered vulnerability in a specific product. It is a design-level assumption embedded in how Zero Trust was conceived: that verifying the identity of the requesting entity is equivalent to governing the actions that follow. For human actors at human speed, that equivalence was imperfect but workable. For agents at machine speed, it does not hold.
How the control boundary dissolves
The mechanism is worth tracing precisely, because it explains why patching individual products does not close the gap.
An AI agent is provisioned with an OAuth token or API key granting access to one or more enterprise systems: a CRM, a document store, a communication platform. The token is legitimate. The provisioning process followed standard identity governance procedures. The agent begins operating, and from the identity layer’s perspective every subsequent action looks identical to the provisioning intent: a valid credential accessing permitted resources.
Three things then happen that the framework was not designed to handle.
The first is token persistence beyond the context that justified it. Human session tokens expire or are revoked when the user’s role changes. Agent tokens are often tied to service accounts with long rotation cycles, or to integrations that are never formally deprovisioned when the use case that created them evolves. The Salesforce/SalesLoft campaign exploited exactly this: attackers obtained OAuth tokens carrying persistent access to CRM data across hundreds of organisations, including Fortune 500 firms, without touching a user credential (IT Governance, 2025). MFA was irrelevant. The token predated the attack.
The second is transitive trust through sub-agent delegation. When Agent A instructs Agent B to query a database and return results, Agent B may inherit the parent’s trust context without independent verification that the delegation was authorised. Which principal is ultimately responsible for Agent B’s actions. Whether its scope is appropriate is typically unanswered in policy. Current enterprise identity frameworks have no standard resolution for this. The implicit assumption is that the chain of delegation is trustworthy because the originating credential was; the assumption is circular, and it compounds with each additional layer.
The third is the removal of the behavioural baseline that anomaly detection relies on. Schneier’s analysis of autonomous hacking agents documents the operational consequence: DARPA’s AI Cyber Challenge teams identified 54 new vulnerabilities in four hours of compute time, while Google’s Big Sleep AI found flaws in open-source projects that human auditors had not detected (Schneier, 2025). An attacker’s agent moving through an enterprise environment at comparable speed: exfiltrating data at the rate an authorised automation workflow would process it does not produce an anomaly signal against a baseline built for human behaviour. The signal the monitoring system is calibrated to detect is absent, not because the attack is subtle, but because the detection model is asking the wrong question.
The combination of persistent tokens, transitive delegation, and machine-speed operation means that the control boundary organisations believed they had built does not extend to the agentic layer of their environment.
What this changes for decision-makers
The practical consequence is not that Zero Trust has failed and must be abandoned. It is that Zero Trust was built to govern one class of actor, and a second class has been introduced into the environment without equivalent governance.
The scale of that second class is growing quickly. Deloitte’s rollout of Anthropic’s Claude to 470,000 employees (Ekamoira, 2025) represents a single enterprise deployment. IBM’s TechXchange introduced watsonx Orchestrate specifically for agent observability at scale (IBM, 2025). The enterprise agent population is not a planning assumption; it is a current operational reality in most large organisations.
The governance gap has a measurable cost structure. Non-human identities: service accounts, API keys, OAuth tokens, agent credentials now outnumber human identities in most enterprise environments, often by a significant margin. The identity governance processes applied to them are, in most cases, less rigorous than those applied to human accounts: longer rotation cycles, less frequent access reviews, weaker deprovisioning discipline. This is not a deliberate policy choice; it reflects the historical assumption that service accounts were stable, low-risk infrastructure components rather than active principals capable of executing complex action chains.
That assumption no longer holds. The implication for anyone who owns security or operational risk is straightforward in principle, though costly in practice: non-human identity governance requires the same rigour as human identity governance, and in some respects more. The speed and scale of potential damage from a compromised agent token is substantially higher than from a compromised user credential. The economics of attack: IBM’s sixteen hours compressed to five minutes, 54 vulnerabilities found in four hours mean the window between compromise and consequence has shortened in ways that make the governance deficit more expensive to carry with each passing month.
The three shifts required to regain the control boundary
Regaining meaningful governance over the agentic layer requires changes at three levels. Each has a natural owner; each has a failure mode when that ownership is unclear.
Token lifecycle management means treating agent credentials with the revocation and rotation discipline currently applied to privileged human accounts. In practice, this begins with a complete audit of non-human identities in the environment: which systems they can reach, what permissions they hold, when those permissions were last reviewed, and whether the use case that justified provisioning still exists. Many will not. Tokens granted for integrations that were extended, expanded, or simply never formally retired carry permissions the organisation may no longer intend to grant. The Salesforce campaign is the model of what happens when that audit has not been done: the attack surface was not a misconfiguration but an accumulation of legitimately provisioned access that had outlived its justification.
Behavioural scope definition moves the governance question from “does this credential have access?” to “is this sequence of actions consistent with the intended purpose of this agent?” This is intent evaluation rather than identity verification, and it requires a different policy instrument. Rather than specifying which resources an agent can access, it specifies what an agent is expected to do with that access, and flags deviations for human review or automated containment before the action chain completes. The Abnormal AI analysis identifies this as the central gap in current Zero Trust implementations (Abnormal AI, 2025): evaluating identity at the point of access leaves intent as it unfolds across an action chain entirely ungoverned.
The ownership question here is genuinely contested, and the contest itself creates the gap. Identity teams own provisioning and access policy. Security operations teams own behavioural monitoring. Neither group currently owns the intersection: defining, enforcing, and monitoring the behavioural scope of AI agents as a distinct governance object. Until that ownership is resolved, typically requiring a decision at CIO or CISO level, the gap persists by default. The cost of that default is not a future risk; it is accumulating in the form of agent populations operating with permissions no one has reviewed against agentic risk criteria.
Response authorisation addresses the timing problem directly. If an autonomous agent can complete a meaningful attack chain in minutes, a response model requiring a human analyst to approve each containment action before it executes is structurally too slow. Defensive AI platforms operating with pre-authorised autonomous response for high-confidence threat categories demonstrate what is achievable: Darktrace’s ActiveAI investigated 23 million events and generated 73 actionable alerts for a single wealth services client, blocking over 18,000 malicious emails that legacy filters had missed (AI Multiple, 2025). The governance question is not whether to permit autonomous defensive action, but how to define the confidence thresholds and action scope that require it, who sets those thresholds, and on what review cycle they are revisited. Leaving that question unanswered is itself an answer: containment waits for a human, and the human arrives too late.
The durable implication
The framing of Zero Trust as a mature, largely solved discipline has made it harder to see where it is inadequate. Organisations that have invested heavily in identity-first architecture have reasonable grounds for confidence about their human-user risk posture. That confidence does not extend to the agentic layer unless the governance work has been done explicitly.
The evidence from the OAuth campaign and from autonomous hacking research points to the same structural problem: the credential is clean, the token is valid, the access is authorised—and none of that tells the governance layer what the agent is actually doing or why. Organisations that treat the resolution of this gap as a future architectural project rather than a current operational priority are, in the meantime, running agent populations whose trust boundaries they cannot describe and whose behaviour they cannot evaluate.
That is not a posture that survives scrutiny at the board level. It is, increasingly, the posture adversaries are being paid to find. A valid token, it turns out, was never quite the guarantee it seemed. ■
