Zero trust was the great security correction of the last decade. The industry finally admitted the castle-and-moat was fiction — that the corporate network perimeter protected nothing worth protecting — and moved the trust decision to identity and device: never trust the network, always verify the accessor, authorize at the application's front door. It was right, it was hard-won, and organizations are still congratulating themselves on completing the migration.
Which is precisely the wrong moment to notice that zero trust smuggled in three assumptions of its own — and all three just expired.
The three assumptions
Look under any classic zero-trust deployment and you find an unexamined trinity. The accessor is a human. Actions occur at human speed. The application is the right boundary for trust. None of these was ever written down as a requirement, because none needed to be — they were simply true of the world in 2014. Verify the person and the device, grant access to the app, and the human's natural cadence — a click here, a query there, coffee in between — kept everything reviewable. If something went wrong, security operations could investigate after the fact, because "after the fact" was minutes or hours, not milliseconds.
Enter AI agents — not as a thought experiment, but as this quarter's workforce reality. Agents acting autonomously or as copilots interact with corporate resources at roughly ten times human rates, and that multiplier is headed the wrong direction. They don't just fetch a record; they aggregate and reason across vast unstructured datasets, touching more sensitive material per hour than an employee once touched per quarter. Infrastructure built to authorize human-paced requests now faces tens of millions of concurrent machine-driven actions. And the "after the fact" that security review depended on? At agent speed, everything interesting is over before a human analyst finishes reading the first alert.
Meanwhile the attackers upgraded on the same schedule. Even unsophisticated adversaries now wield models that rewrite malicious code on demand — eroding static, signature-shaped detection — and deploy patient, automated probing against surfaces once considered too low-value to bother with. Machine-speed offense against human-speed defense isn't a fair fight; it isn't a fight at all.
Ambient authority: the flaw that agents weaponize
But the deepest crack isn't speed. It's what we've been authorizing. Application-level trust means that once you're in, you're in — the app is the gate, and everything reachable inside it is implicitly yours. For humans, that coarseness was tolerable, papered over by norms, judgment, and the sheer slowness of hands on keyboards. An employee with technical access to ten thousand documents actually opens twelve of them, the twelve their job requires.
Now hand that same account to an agent — because that's what a copilot is: software wearing its user's full permissions. Security folks have a name for this inherited-everything pattern: ambient authority. The agent tasked with summarizing Northeast sales can, with perfect legitimacy at the application layer, also read the strategic planning documents, the HR records, and whatever else the chronically overprovisioned human could technically touch. It won't hesitate the way a person might; it doesn't share the person's tacit sense of "that's not mine to read." And if a prompt injection or a poisoned document steers it, it will exercise the full breadth of that inherited authority at machine speed. Overprovisioning used to be latent risk. Agents make it kinetic.
Here's the sentence I keep repeating in design reviews: an agent doesn't need your job's access — it needs this task's access. Application-level authorization cannot express that sentence. Which is why the trust boundary has to shrink again.
From "can you enter the building?" to "can you touch this object?"
The correction taking shape — visible in work now emerging from the largest security engineering organizations — moves the authorization decision from the application to the individual action on the individual resource. Not "may this identity use the document system?" but "may this accessor, in this context, perform this operation, on this specific object, right now?" — evaluated per action, wherever the resource is reached: front-end, API, or an agent's tool call. The same question, asked the same way, whether the finger on the button is human or synthetic.
That reframing does something subtle and powerful to permissions: they stop being a static grant and become a dynamic envelope that flexes with the work. Your access expands toward what your current task genuinely requires and contracts away from what it doesn't — reducing overprovisioning continuously rather than in annual entitlement-review theater, without burying anyone in approval requests. For agents, the envelope can be tied to the task and the controlling human, which is the only scoping that ever made sense for a delegated actor.
Skeptics will note, correctly, that per-action decisions at agent volumes sound computationally insane — millions of context-rich verdicts per second, within latency budgets users won't notice. That's a real engineering problem with a real architecture behind it (precomputed context, layered fast-and-slow evaluation — a topic for its own essay). The point here is prior to the engineering: the unit of trust was wrong. We spent a decade correctly distrusting the network, then parked all the reclaimed trust at the application layer — an aggregation that only worked because humans were slow and few. The agentic enterprise is neither.
Every security era ends the same way: the assumptions that were too obvious to state become the vulnerabilities too big to patch. Perimeter security assumed the inside was safe. Zero trust assumed the accessor was human, the pace was human, and the app was the atom. The next model starts where those assumptions failed — at the action, on the resource, in the moment. Trust, it turns out, keeps shrinking. That's not a failure of the previous generation. It's the direction the whole story was always pointed.
