Zero Trust Meets Agentic: Securing Organisations for Agentic Work

This article is written based on an interview with Dr Swamy Kocherlakota, Chief AI Officer, Zscaler

For the better part of a decade, the concept of Zero Trust has been the undisputed North Star of enterprise cybersecurity. We have preached its gospel across boardrooms and IT seminars: never trust, always verify. We built intricate architectures around the principle that every human user attempting to access corporate networks must prove their identity, authenticate their credentials, and be slotted into tightly controlled access tiers. We treated the network edge like a heavily guarded fortress, assuming that once a human user cleared the gates, their actions could be governed by rigid permissions.

But as we settle into an era defined by hyper-advanced automation, that comfortable perimeter has not just been breached—it has been rendered entirely obsolete. The modern digital workforce is no longer populated solely by human employees clicking through browser tabs and spreadsheets. It is increasingly driven by Agentic AI: autonomous software-defined entities capable of executing multi-step workflows, invoking external APIs, downloading specialised micro-skills, and communicating directly with other machine agents across the cloud.

When software stops acting like a passive tool and starts behaving like an independent workforce, our entire philosophy of trust and verification has to evolve. To understand how enterprises can survive this seismic shift without grinding productivity to a halt, we sat down with Dr Swamy Kocherlakota, Chief AI Officer at Zscaler, during Zenith Live 26. Coming from the enterprise “buy-side” as a former chief digital solutions officer before joining forces with Jay Chaudhuri to build Zscaler’s cutting-edge AI protection suite, Dr Swamy offered a sobering look at what happens when autonomous code is set loose inside an organisation.

The Evolution of Automation: From Chatbots to Autonomous Agents

To grasp why traditional security models fail against modern AI, we first have to recognise how rapidly the technology has matured. We are no longer talking about simple static chatbots that spit out pre-scripted customer service replies or summarise corporate PDFs. Agentic AI spans a wide and rapidly expanding spectrum. At its baseline, it can answer complex queries or execute isolated tasks on command. But at its upper tier, it operates as a fully autonomous agent—capable of breaking down a high-level business objective into dozens of micro-tasks, orchestrating software tools, and executing workflows across enterprise systems without human intervention.

As Dr Swamy pointed out during our conversation, this autonomy introduces unprecedented operational dynamics: “Agentic AI is a spectrum. You could use it to answer a question or do a task for you, or it can be a fully autonomous agent. You would want to make sure that an agent is talking to the right other agents. It’s downloading the right skills and the right tools.”

Think about what that actually means in a live enterprise environment. An AI agent deployed in a supply chain department might autonomously communicate with a vendor’s inventory agent, negotiate pricing parameters, fetch documentation from a shared cloud drive, and execute a purchase order. Another agent in the marketing division might scrape data from multiple web platforms, generate creative assets, and deploy ad campaigns across social media channels.

These aren’t passive applications waiting for a mouse click; they are active, autonomous workers executing code and moving data at machine speed. If an agent goes rogue, misinterprets an objective, or downloads a malicious plugin from an unvetted public skill store, the resulting damage happens before a human administrator even realises a script has run.

Traditional Perimeters Crumble Under Machine Velocity

For years, network security relied heavily on static identity management. We knew who Bob in accounting was because Bob logged in with his corporate credentials, authenticated via multi-factor authentication, and sat behind an enterprise firewall. But how do you authenticate an AI agent that spins up dynamically to solve a specific problem, communicates across disparate cloud environments, and then terminates its own instance?

Traditional perimeter security treats network traffic as a binary proposition: inside the perimeter is trusted; outside is untrusted. Zero Trust was designed to dismantle that lazy assumption by demanding continuous verification of human identity. Yet, applying Zero Trust to machines requires an entirely different operational mindset. When software acts with agency, identity is no longer just a username and password; it is a complex web of contextual metadata, authorisation boundaries, and behavioural intent.

When we discussed how Zero Trust principles map onto this new reality, Dr Swamy made it clear that Zero Trust isn’t a radical, disruptive invention when applied to AI; rather, it is simply the cleanest, most logical best practice available to enterprise architects. As he noted, “Zero Trust is a clean way to do it. And, you know, in technology, there are many ways to do things, but usually there’s one best practice or two best practices. Whereas a CIO, you have only one policy engine that governs everything, Zero Trust is the right way to do it.”

That centralisation is the crux of the matter. In a modern enterprise, you cannot have separate security silos governing human employees, cloud workloads, and AI agents. You need a unified policy engine that speaks a universal language, enforcing consistent rules regardless of whether a request originates from a human laptop in Kuala Lumpur or an autonomous agent running in an AWS container cluster.

Checkpoints & Constant Verification Are Paramount

During our interview at Zenith Live, Dr Swamy used a remarkably simple, brilliant physical analogy to explain how Zero Trust architecture translates to the real world—and by extension, how it must be applied to artificial intelligence. Pointing to our conference lanyards, he broke down the layers of identity and access control:

“See, you’re wearing this badge, right? Yeah. This is given as an identity right now. Nobody else without this identity can come inside the building. And you see how mine is? Black. Yours is blue. I have a little dot here. You don’t have a little dot there. I have this little grey colour exchange. This is all the metadata associated with the identity. And you see those green shirt people that are standing and looking? They are enforcement points. We don’t have the badge; they won’t come in. You need to have a meeting. You’ve got to check in. So Zero Trust is that – you have an identity and you have a policy of what you can do and what you can’t do. And then you have policy enforcement points that tell you what you can do or not.”

Translate that physical security model into the digital architecture of Agentic AI, and the blueprint for modern enterprise defence snaps into sharp focus.

Every AI agent operating within your ecosystem must carry a verifiable cryptographic identity—its digital “badge.” That badge must be rich with metadata: Who created this agent? What department does it belong to? What data sources is it authorised to touch? What external skills or tools is it permitted to download?

When an agent attempts to execute a task, it encounters a digital policy enforcement point—the software equivalent of the security personnel standing at the conference hall door. If an autonomous marketing agent attempts to pull proprietary customer data from a restricted financial database without the appropriate metadata credentials on its badge, the enforcement point intercepts the request and blocks it instantly.

Furthermore, this verification cannot be a one-time event checked at login. Because AI agents operate dynamically over extended workflows, Zero Trust demands continuous validation of intent. As Dr Swamy emphasised, enterprises must evaluate what an agent is trying to achieve in real-time, matching its actions against strict intent-based policies that define not only what the technology is allowed to do, but explicitly what it is not allowed to do.

Building the Autonomous Guardrails

As organisations rush to integrate Agentic AI into their daily operations—from customer support automation to software development pipelines—the temptation to run fast and break things remains high. But the stakes are vastly different today than they were during the early days of cloud computing or mobile app adoption. When an app misbehaves, it crashes or throws an error code. When an autonomous AI agent misinterprets an objective or gets hijacked by an unvetted plugin, it can exfiltrate intellectual property, violate regulatory compliance standards, or haemorrhage financial capital through unmonitored token consumption.

Securing the autonomous digital workforce requires CIOs and CISOs to stop viewing AI security as an isolated software patch. It requires embracing a comprehensive, zero-trust framework where every agent is treated as an active participant in the enterprise ecosystem—subject to strict identity verification, rich metadata accounting, and relentless inline policy enforcement.

Autonomous agents working alongside human teams will undoubtedly write the future of business efficiency. But to capture that promise without inviting operational chaos, enterprises must build digital guardrails now. By treating machine identity with the same rigorous discipline we apply to human credentials, organisations can ensure that their autonomous workforce remains an engine of growth rather than a vector for disaster.

---