Agent Access Model

BeyondCorp and Zero Trust changed enterprise security by determining access based on user identity and device status rather than request origin. However, these models are designed around people and devices, assuming a single actor operating at human speed.

AI agents are software actors that perform multiple tasks and move data rapidly between systems. A single instruction can create a task execution graph that accesses databases, source code repositories, logs, ticketing systems, documents, spreadsheets, and more; when the task ends, those permissions must disappear immediately.

Existing controls for human and service accounts reveal four major issues when applied to agents.

• Credential lifetime mismatch: Agents may run for minutes, but service account keys and permissions persist long-term, increasing the risk of reuse and theft.
• Machine speed: Agents can read databases and exfiltrate data before humans can detect or respond, requiring inline preventive controls rather than post-hoc detection.
• Prompt limitations: Instructions like "do not access production" guide behavior but do not enforce access. Actual enforcement must occur at the harness layer mediating tool calls and the network layer controlling packets.
• Excessive privileges and insufficient visibility: Long-running services with broad permissions can lead to access beyond the task scope and audit gaps.

The proposed Agent Access Model (AAM) focuses on reducing the scope of capabilities and permissions agents hold from the start, rather than making each access decision smarter. It sets permission ceilings and trust levels per task, granting running agents only the necessary permissions to apply the principle of least privilege in real time.

This model distinguishes between single-actor controls implementable today and the more difficult multiplayer access control problem that arises when multiple actors are involved in a single task. The core lies in aligning agent permission lifetimes with task lifetimes, proactively controlling all tool calls and network access, and maintaining auditable execution records.