Analyzing Zero Trust Architecture in the Age of Agentic GenAI

Vinit Narjala, Application Security Engineer at AWS, presents a framework for securing autonomous AI agents using zero trust principles. He distinguishes agentic AI from traditional LLMs by highlighting agents' planning, reasoning, memory (short and long-term), tool integration, and autonomous action capabilities—creating significantly larger attack surfaces. Narjala identifies four new threat domains beyond traditional appsec: cognitive security (reasoning hijacking, goal manipulation), execution integrity (tool misuse, code execution risks), identity coherence (authentication/authorization across agent lifecycles), and governance complexity (multi-agent delegation chains). He maps 15 OWASP agentic AI threats into the ATFAA (Advanced Framework for Autonomous Agents) framework. The core defense strategy is ATBMF (Adaptive Trust Boundary Management Framework), a three-pillar approach: (1) Multi-dimensional Monitoring and Observability—capturing action-intent correlation, data access patterns, resource utilization, and communication patterns via deterministic hooks into agent workflows; (2) Dynamic Policy Enforcement—using graduated access (full/limited/read-only/deny), just-in-time privileges, automatic credential revocation, and contextual reauthentication to adjust trust boundaries in real-time based on risk scores; (3) Self-Healing Procedures—network isolation, quarantining, graceful degradation, and forensic state preservation. Narjala demonstrates an AWS implementation with API Gateway and Lambda fronting agents, where Lambda enforces policies before requests reach agents and dynamically attaches scoped IAM policies based on intent and risk profile. Real-world vulnerabilities cited include Outlook Copilot exfiltrating Slack tokens via prompt injection, Morse code bypassing guardrails, and steganographic image injection. The framework balances developer velocity with security by enabling controlled innovation in sandboxed environments rather than blocking adoption. Key mitigations include avoiding code execution access unless necessary, network isolating per-user interactions, using VMs for isolation, never passing credentials to agents, limiting input prompts to predefined options (like SQL stored procedures), and maintaining deterministic security decisions independent of model outputs. Narjala emphasizes that prompt injection is a built-in feature, not a bug, making architectural controls and guardrails paramount. The three core takeaways: operationalize AI with zero trust, model the agent itself (not just the application), and enable developers while keeping security satisfied.