What is Zero Trust (Agent)?

Zero trust architecture emerged in network security as a rejection of the perimeter model — the idea that anything inside the firewall is trusted. The same paradigm shift is needed for AI agents. The naive assumption that 'our agent is safe because we wrote the system prompt' is the agent equivalent of trusting everything inside the firewall.

In a zero trust agent architecture, every tool call is evaluated independently. An agent that successfully called a tool ten times does not earn implicit trust for the eleventh call. Each invocation is checked against policy based on the tool, the arguments, the context, and the constraints — not on the agent's identity or history.

This model is essential because AI agents are non-deterministic. The same agent with the same system prompt can produce different tool calls on different runs. A prompt injection midway through a session can change the agent's behaviour entirely. Trust based on identity ('this is our code review agent, it is safe') is meaningless when the agent's behaviour can shift unpredictably.

Zero trust also applies to MCP servers. A server that was legitimate yesterday may be compromised today. Tool responses that were benign in one context may contain poisoned content in another. Every interaction across every trust boundary requires verification.

Intercept implements zero trust for MCP by evaluating every tool call against YAML policies, regardless of source. There is no concept of a 'trusted agent' that bypasses policy — every invocation, from every client, passes through the same policy evaluation pipeline. This is enforced architecturally: Intercept is the only path between client and server, so there is no way to establish a trusted backchannel. The audit trail provides full accountability, recording every decision for post-hoc analysis and compliance.