As artificial intelligence moves beyond generating recommendations to executing autonomous actions across enterprise environments, security leaders face a new challenge: how do you control an entity that can make decisions, access information and interact with systems at machine speed? Agentic AI is blurring the traditional boundaries between human users, devices and applications, creating new vulnerabilities around identity, privileged access, data aggregation and operational security. For organizations embracing autonomous AI, traditional security models and model-level guardrails are not enough.

A more comprehensive approach to Zero Trust, built around dynamic permissions, least-privilege access, architectural segmentation and continuous monitoring, is becoming essential. John Sahlin, Vice President of Cyber Solutions at General Dynamics Information Technology (GDIT), examines the emerging security implications of agentic AI and explains why organizations must rethink how they establish trust, protect critical data and contain unintended AI behavior. His message: secure the architecture before putting autonomous agents to work.

SecurityInfoWatch (SIW) -- As AI agents move from generating recommendations to taking autonomous actions across enterprise systems, how should security leaders rethink the traditional distinction between a user, a device and a machine when defining identity and access controls?

John Sahlin: This gets to the heart of securing agentic systems. The starting point for protecting data in a Zero Trust environment is establishing a non-repudiable identity for every actor requiring access to systems and information.

AI agents complicate that approach because they don't fit neatly into the traditional categories of users, devices or machines. They operate at the intersection of all three. They can act autonomously like human users, follow rules like machines and independently explore an environment to determine what actions they can take.

SIW -- We have seen AI systems behave unexpectedly, including gaining unintended access to systems or continuing to pursue objectives after crossing security boundaries. What do these incidents tell us about the limitations of relying on the AI model itself to enforce security?

Sahlin: Agents are different because they may try virtually every possible approach, including actions that don't appear logical to humans or conform to established rules. Frontier-model testing has demonstrated that models can escape sandbox environments and chain together low-criticality vulnerabilities to produce high-value impacts in simulated and production environments.

We cannot rely on models or traditional role-based access controls alone to govern agent behavior.

I took Hunter's Education in middle school growing up in Arkansas. One of the first lessons in firearm safety is to treat every firearm as if it is loaded. We need a similar principle for agentic AI: Treat every agent as if it has direct access to the Internet and will break its guardrails.

That means establishing a controlled environment for developing and deploying AI systems. Organizations must conduct a holistic review of their architecture, establish model guardrails, and create security boundaries that reduce the blast radius of unexpected behavior.

We need to contain breaches and guardrail failures before they cause irreparable damage. As organizations race to field AI capabilities, they must run a parallel effort to secure them. A Secure by Design approach must be embedded in the underlying architecture from the beginning.

SIW -- Zero Trust is built around continuously verifying identity, context and authorization rather than implicitly trusting an entity. How does that philosophy translate when the entity making a request is an autonomous AI agent capable of dynamically choosing tools, data sources and actions?

Sahlin: Agents should receive the least privilege possible, which is almost none. If an agent needs elevated permissions, those privileges should be checked out temporarily, assigned for a specific purpose, monitored and recorded through an immutable audit log.

That requires a Privileged Access Management (PAM) engine that can vault privileged credentials and release them conditionally. Organizations also need application-, service-, data- and model-level security enclaving, with least privilege as the default: persistent deny-all access and temporary permission by exception.

This is the minimum requirement for implementing Zero Trust for AI.

Traditional Zero Trust evaluates each request and makes dynamic access-control decisions based on identity, context and authorization. With agentic AI, we must ensure that agents do not maintain persistent attributes or privileges they could exploit at machine speed.

Conditional and dynamic access controls are essential. Organizations need to understand what an agent is attempting to do, establish whether that action is authorized and maintain an auditable record before granting access to systems or data.

SIW --  One of the biggest concerns with agentic AI is the potential for sensitive information to become unintentionally exposed or combined across systems. What Zero Trust principles can organizations use to prevent an AI agent from turning legitimate access to multiple data sources into an unintended data-security problem?

Sahlin: This is difficult because it assumes an organization already understands which data can be combined and which datasets should remain separate based on their classification and sensitivity.

My name and address, for example, may be public records. But if those records are combined with nonpublic information, such as my Social Security number or medical information maintained in an HR database, the resulting aggregation creates a much more sensitive record.

Data is the digital asset of any organization. Yet many organizations have not adequately audited their data to understand its provenance or its impact on the organization's mission.

Think about what you would take with you if your house were on fire. Some possessions have value but are easily replaceable. Others are mission-critical and difficult or impossible to replace. Organizations need to take the same inventory of their digital assets and understand how individual data sources support their business and operational objectives.

The relative value of a digital asset can also change as the mission or tactical situation evolves. I once heard a service member say that unclassified email traffic would never be his highest-priority data stream. That might be true under normal circumstances. But what if that email system is the only platform in a theater supporting a humanitarian assistance mission, providing an operational picture that first responders need to save lives?

This is why data auditing is a fundamental Zero Trust requirement. Agentic AI is designed to combine information to solve problems, and it does so at machine speed. Without understanding data flows, provenance, and mission impact, organizations cannot establish meaningful governance over which datasets agents can combine.

Once those rules are established, organizations can apply data-centric and model-centric security controls to govern access to information and the functions that bring it together. Technology can help enforce those policies, but the starting point is understanding the data, its value to the mission and the rules governing its use.

SIW -- If organizations accept that they may not be able to predict or prevent every instance of unexpected AI behavior, what does a practical blast-radius strategy look like, and which controls should be in place to contain an agent when it begins acting outside its intended mission?

Sahlin: This brings us back to the need for a holistic architectural approach. I recognize that evaluating core infrastructure isn't as glamorous as deploying agents to accelerate business operations, but it is essential.

Organizations need to ask some basic questions. Have we done the foundational work to protect our systems and data against a breach? Have we assessed our data sources and determined how each supports our mission or business objectives? Have we established effective cybersecurity hygiene practices?

Most importantly, have we smoke-tested our own environments to determine whether an agent could chain low-criticality vulnerabilities to produce much more significant consequences?

We need to make sure our house is built on a solid foundation before introducing the dynamic and unpredictable nature of agentic AI.

If the underlying cybersecurity architecture is already shaky, adding autonomous agents can feel like balancing spinning plates while riding a unicycle across a tightrope in a windstorm.

The objective is to identify weaknesses before an agent does, establish boundaries that limit access and movement, and ensure the organization has the architectural safeguards necessary to contain unintended activity.

SIW -- Looking ahead, what should security executives be doing now, before autonomous agents become deeply embedded in business operations, to establish an identity, Zero Trust, and governance framework that lets organizations gain the benefits of agentic AI without creating a new class of unmanaged digital insiders?

Sahlin: I wish I could say these requirements are specific to agentic AI, but they aren't. Organizations need to get the fundamentals right. Agents are the ultimate insiders. They don't sleep, get distracted or fear discovery.

That means we must remain vigilant about the basic protections that defend against insider threats and advanced persistent threat actors. I would focus on five priorities:

1. Establish clear objectives for using agentic AI. Determine which business problems you are trying to solve. If you don't understand how agents will be used, you cannot identify the rulesets they must follow or the environmental boundaries that need protection.

2. Understand your data. Know how information is produced, processed and stored. Trace how it supports the organization's mission, prioritize digital assets and establish rules governing which datasets can and cannot be combined.

3. Assess your cybersecurity architecture. Determine whether your environment is built on solid ground or shifting sands. Evaluate segmentation and security enclaving across systems, applications, data and models.

4. Evaluate cybersecurity hygiene. Assess fundamental hardening and patching practices. Smoke-test the environment to identify weaknesses that may have gone unnoticed, and establish compensating controls to limit the blast radius if an agent violates its guardrails.

5. Conduct an agentic AI cybersecurity tabletop exercise. Ask your team how it would recognize an agent operating outside its authorized boundaries. Do security professionals understand how indicators of compromise may change in an agentic environment? Have they considered how incident response must adapt when autonomous systems operate at machine speed?

Ultimately, organizations cannot treat agentic AI as simply another technology deployment. They must understand the mission, secure the underlying architecture and establish the governance and controls necessary to keep autonomous agents within authorized boundaries.