Zero Trust for AI Agents: Why Identity-Based Security Collapses When Machines Call the Shots

Zero Trust says "never trust, always verify." But verify what, exactly, when the requester is an autonomous agent that spawns sub-agents, delegates credentials, and makes 1,500 API calls per prompt? Identity-based security was designed for humans. The agent economy needs something fundamentally different. If you've spent any time in enterprise security, you know Zero Trust. Verify every request. Authenticate every user. Trust no network segment implicitly. It's the dominant security paradigm for good reason — it replaced the broken "castle and moat" model that assumed everything inside the perimeter was safe. But Zero Trust was built for a world where humans sit at keyboards, devices have certificates, and access patterns are predictable. AI agents break every one of those assumptions. And the security industry hasn't caught up yet. What Zero Trust Actually Assumes Before we can talk about where Zero Trust breaks, we need to be precise about what it assumes. The NIST SP 800-207 Zero Tr