Zero Trust for AI Agents
How AWS and Microsoft Azure approached the emerging agentic workforce — a December 2025 snapshot reviewed in August 2026
Evidence boundary: This downloadable paper preserves a December 2025 market snapshot and is not a continuously maintained product matrix. Product names, availability, licensing, and control behavior can change. Read the maintained companion article and current Microsoft Entra Agent ID and Amazon Bedrock AgentCore Identity documentation before making deployment decisions.
AI Agents Are the New Attack Surface
AI agents can browse the web, execute code, access databases, and interact with third-party services autonomously. Each capability represents a potential attack vector.
Four Progressive Agency Scopes
AWS describes four progressive scopes. The levels are not Cartesian risk quadrants: each step adds agency and calls for controls appropriate to the agent's data, actions, environment, and failure impact.
AWS Agentic AI Security Scoping Model
1. No Agency
Deterministic workflows with no autonomous decisions. Still require strict validation, state integrity, isolation, resource limits, monitoring, and audit trails.
2. Prescribed Agency
The agent chooses among explicitly allowed actions. Constrain tools, permissions, inputs, outputs, and execution paths.
3. Supervised Agency
The agent plans or acts with human or policy checkpoints. Define escalation, approval, observability, and rollback boundaries.
4. Full Agency
The agent operates with broad autonomy. Apply the strongest identity, authorization, containment, monitoring, evaluation, and incident-response controls.
AWS vs Microsoft: Two Approaches to Agent Security
Both hyperscalers recognized the agentic AI inflection point in 2025 and delivered comprehensive frameworks. Here's how they compare.
Bedrock AgentCore
-
AgentCore Identity
Purpose-built IAM for agents with OAuth 2.0, OIDC, and token vault
-
Bedrock Guardrails
AWS reports blocking up to 88% of harmful content in its cited evaluations, with configurable PII detection and masking
-
AgentCore Evaluations
13 pre-built evaluators with continuous monitoring and regression alerts
-
AgenticTrust
Cryptographic verification in partnership with HUMAN
Agentic Zero Trust
-
Entra ID for Agents
Extended identity platform with Managed Identity and Conditional Access
-
Azure AI Content Safety
Content filtering with prompt shields and jailbreak detection
-
Defender + Sentinel
AI-powered SIEM with multi-cloud visibility including AWS
-
Zero Trust Framework
Assume breach, verify explicitly, least privilege access
| Capability | AWS Bedrock AgentCore | Microsoft Agentic Zero Trust |
|---|---|---|
| Agent Identity Service | AgentCore Identity (purpose-built) | Entra ID (extended for agents) |
| Permission Model | IAM roles + temporary credentials + JIT | Least privilege + Managed Identity |
| Behavioral Guardrails | Bedrock Guardrails (AWS reports up to 88% in cited evaluations) | Azure AI Content Safety |
| Security Framework | Agentic AI Security Scoping Matrix | Zero Trust for Agentic Workforce |
| Continuous Monitoring | AgentCore Evaluations (13 evaluators) | Defender for Cloud + Sentinel |
| Cryptographic Trust | HUMAN AgenticTrust integration | Managed identity, federated identity credentials, and token issuance |
| Cross-Cloud Support | ApplyGuardrail API (any model) | Defender covers AWS workloads |
| Best For | Multi-model, greenfield, compliance | Microsoft ecosystem, existing Entra |
Recommended Zero Trust Agent Control Flow
This is a recommended reference pattern, not an automatic pipeline supplied by either platform. Compose and configure identity, authorization, action policy, content safety, logging, and response controls for the risk of each agent workflow.
Implementation Roadmap
A phased approach to securing agentic AI in your organization.
- Inventory all AI agents
- Map current permissions
- Identify high-risk agents
- Assess autonomy levels
- Deploy agent identity mgmt
- Implement temp credentials
- Define RBAC policies
- Enable JIT access
- Deploy guardrails
- Configure evaluations
- Set up HITL workflows
- Enable audit logging
- Document policies
- Enable attestation
- Integrate with SOC
- Schedule access reviews
The 63% Assessment Gap
In the World Economic Forum's 2025 survey, 37% reported processes to assess AI-tool security before deployment; 63% did not report such a process. That is not proof that they deploy with no checks, but it identifies a formal-governance gap.
Organizations that establish robust agent security frameworks now can move more deliberately as agentic AI matures.
The agentic era isn't coming — it's here.
📚 References
- Microsoft Security Blog. "Microsoft extends Zero Trust to secure the agentic workforce." May 2025.
- AWS Machine Learning Blog. "Introducing Amazon Bedrock AgentCore Identity." December 2025.
- AWS Security Blog. "The Agentic AI Security Scoping Matrix." 2025.
- Amazon Web Services. "Amazon Bedrock Guardrails."
- AWS Security Blog. "AWS launches AI-enhanced security innovations at re:Invent 2025."
- DXC Technology. "Security Leaders Embrace Zero Trust but Lag on AI Security Tools." October 2025.
- Cloud Security Alliance. "Zero Trust is Not Enough." April 2025.
- ISACA. "Zero Trust in the Age of AI." 2025.
- HUMAN Security. "HUMAN Delivers Cryptographic Verification of Amazon Bedrock AgentCore Browser to Establish Trust Between AI Agents Built on AWS Infrastructure." December 2025.
- World Economic Forum. "Global Cybersecurity Outlook 2025: Executive Summary." January 2025.