December 2025 • Published Snapshot
🔐 Cloud Security Deep Dive

Zero Trust for AI Agents

How AWS and Microsoft Azure approached the emerging agentic workforce — a December 2025 snapshot reviewed in August 2026

📖 12 min read
✍️ Jerrad Dahlager
📅 December 22, 2025

Evidence boundary: This downloadable paper preserves a December 2025 market snapshot and is not a continuously maintained product matrix. Product names, availability, licensing, and control behavior can change. Read the maintained companion article and current Microsoft Entra Agent ID and Amazon Bedrock AgentCore Identity documentation before making deployment decisions.

ID
give every agent an owned, auditable identity
Scope
grant only the resources and actions required
Guard
validate inputs, actions, and outputs at explicit boundaries
Audit
retain decisions and review anomalous behavior

AI Agents Are the New Attack Surface

AI agents can browse the web, execute code, access databases, and interact with third-party services autonomously. Each capability represents a potential attack vector.

🤖 AI AGENT
🔓 GitHub Repos
💼 Salesforce CRM
💬 Slack Channels
🗄️ Customer Database
📧 Email (as User)
☁️ AWS S3 Buckets
⚙️ Execute Code
🌐 Browse Web

Four Progressive Agency Scopes

AWS describes four progressive scopes. The levels are not Cartesian risk quadrants: each step adds agency and calls for controls appropriate to the agent's data, actions, environment, and failure impact.

AWS Agentic AI Security Scoping Model

PROGRESSIVE AGENCY SCOPES

1. No Agency

Deterministic workflows with no autonomous decisions. Still require strict validation, state integrity, isolation, resource limits, monitoring, and audit trails.

2. Prescribed Agency

The agent chooses among explicitly allowed actions. Constrain tools, permissions, inputs, outputs, and execution paths.

3. Supervised Agency

The agent plans or acts with human or policy checkpoints. Define escalation, approval, observability, and rollback boundaries.

4. Full Agency

The agent operates with broad autonomy. Apply the strongest identity, authorization, containment, monitoring, evaluation, and incident-response controls.

LOWER AGENCY → HIGHER AGENCY

AWS vs Microsoft: Two Approaches to Agent Security

Both hyperscalers recognized the agentic AI inflection point in 2025 and delivered comprehensive frameworks. Here's how they compare.

AWS

Bedrock AgentCore

  • 🔐

    AgentCore Identity

    Purpose-built IAM for agents with OAuth 2.0, OIDC, and token vault

  • 🛡️

    Bedrock Guardrails

    AWS reports blocking up to 88% of harmful content in its cited evaluations, with configurable PII detection and masking

  • 📊

    AgentCore Evaluations

    13 pre-built evaluators with continuous monitoring and regression alerts

  • 🔏

    AgenticTrust

    Cryptographic verification in partnership with HUMAN

Azure

Agentic Zero Trust

  • 🔐

    Entra ID for Agents

    Extended identity platform with Managed Identity and Conditional Access

  • 🛡️

    Azure AI Content Safety

    Content filtering with prompt shields and jailbreak detection

  • 📊

    Defender + Sentinel

    AI-powered SIEM with multi-cloud visibility including AWS

  • 🔏

    Zero Trust Framework

    Assume breach, verify explicitly, least privilege access

Capability AWS Bedrock AgentCore Microsoft Agentic Zero Trust
Agent Identity Service AgentCore Identity (purpose-built) Entra ID (extended for agents)
Permission Model IAM roles + temporary credentials + JIT Least privilege + Managed Identity
Behavioral Guardrails Bedrock Guardrails (AWS reports up to 88% in cited evaluations) Azure AI Content Safety
Security Framework Agentic AI Security Scoping Matrix Zero Trust for Agentic Workforce
Continuous Monitoring AgentCore Evaluations (13 evaluators) Defender for Cloud + Sentinel
Cryptographic Trust HUMAN AgenticTrust integration Managed identity, federated identity credentials, and token issuance
Cross-Cloud Support ApplyGuardrail API (any model) Defender covers AWS workloads
Best For Multi-model, greenfield, compliance Microsoft ecosystem, existing Entra

Recommended Zero Trust Agent Control Flow

This is a recommended reference pattern, not an automatic pipeline supplied by either platform. Compose and configure identity, authorization, action policy, content safety, logging, and response controls for the risk of each agent workflow.

Request → Authenticate → Authorize → Evaluate → Execute → Observe
1
Identity Check
Authenticate the configured workload or agent identity
2
Scope Permissions
Authorize the requested resource, action, and context
3
Pre-Check
Apply configured policy, approval, and content checks where relevant
4
Post-Check
Record the decision and apply configured output controls

Implementation Roadmap

A phased approach to securing agentic AI in your organization.

Phase 1
Discovery & Assessment
  • Inventory all AI agents
  • Map current permissions
  • Identify high-risk agents
  • Assess autonomy levels
Phase 2
Identity Foundation
  • Deploy agent identity mgmt
  • Implement temp credentials
  • Define RBAC policies
  • Enable JIT access
Phase 3
Behavioral Controls
  • Deploy guardrails
  • Configure evaluations
  • Set up HITL workflows
  • Enable audit logging
Phase 4
Governance
  • Document policies
  • Enable attestation
  • Integrate with SOC
  • Schedule access reviews
37%
63%
✅ Assess AI security ⚠️ Lack a formal assessment process

The 63% Assessment Gap

In the World Economic Forum's 2025 survey, 37% reported processes to assess AI-tool security before deployment; 63% did not report such a process. That is not proof that they deploy with no checks, but it identifies a formal-governance gap. Organizations that establish robust agent security frameworks now can move more deliberately as agentic AI matures.
The agentic era isn't coming — it's here.