Zero Trust Architecture

零信任架构由Forrester Research分析师John Kindervag于2010年提出

The practical framework for zero-trust architecture is defined by the NIST SP 800-207 standard, with core components including the Policy Engine, Policy Administrator, and Policy Enforcement Point.

The zero-trust model was proposed by Forrester Research in 2010, with the core principle of never trust, always verify.

Zero Trust Architecture (ZTA), with "never trust, always verify" as its core principle, was first proposed by Forrester Research in 2010.

Google's BeyondCorp project is the most well-known enterprise-level implementation of zero-trust architecture.

零信任架构（Zero Trust Architecture）的核心原则是「永不信任，始终验证」

In AI agent scenarios, an agent can reach targets never authorized by the operator under the guise of legitimately using tools, without any malicious intent, rendering security strategies based on intent judgment ineffective.

The NIST SP 800-207 standard defines in detail the reference model for Zero Trust Architecture

Google's BeyondCorp and the NIST SP 800-207 Zero Trust Architecture standard provide reference frameworks, but zero trust practices for non-human identities (NHI) are still in early stages of exploration.

Zero-trust architecture requires that every access request must undergo identity verification and authorization checks, regardless of whether the request originates from inside or outside the network.

The principle of least privilege originates from the classic 1975 paper on system security design by Saltzer and Schroeder, and is one of the core pillars of zero-trust architecture.

Deploying a zero-trust architecture can limit the potential damage range through network segmentation and behavioral monitoring in scenarios where hardware is assumed to be untrustworthy.

Applying zero-trust architecture principles in the Agent security domain means that every tool call made by an Agent should not be automatically trusted simply because it has been verified previously.

Agentic identity falls under the category of "non-human identity management" (NHI) and is an extension of zero-trust architecture into AI scenarios.

The zero trust model separates the policy decision point (PDP) from the policy enforcement point (PEP), with the PDP centrally evaluating context and then issuing authorization decisions.

Binding Raft inter-node replication traffic to a dedicated network interface enables fault-domain and bandwidth-domain isolation and satisfies the requirement under zero-trust architectures that control-plane traffic not leave the private subnet.

Most current zero-trust practices still start from 'verified identity', and when dealing with a completely unknown, unregistered autonomous agent making a request for the first time, the zero-trust model has a blind spot at the 'first contact' stage.

In a zero trust architecture, the AI agent gateway plays the role of a policy enforcement point (PEP), and the identity provider and policy engine constitute the policy decision point (PDP).

Transplanting zero-trust architecture concepts into AI systems with autonomous reasoning capabilities still faces multiple trade-offs among latency, interpretability, and user experience.

The Agent governance approach is highly aligned with the zero-trust architecture philosophy in enterprise security, meaning no entity is trusted by default and every action is independently verified.