Your AI Agents Can Act. Can Your Security Model Keep Up?

An AI assistant that writes a paragraph creates one kind of risk. An agent that retrieves customer records, invokes an API and changes a business system creates another.

The difference is not simply a more capable model. It is the authority surrounding that model: the identity it uses, the data it can reach and the actions its tools permit. A useful agent can move work forward quickly. An overprivileged one can move a mistake just as quickly.

That is the starting point for my O’Reilly live course, Zero Trust for AI Systems. We look beyond the model itself to the security decisions that make an AI-enabled workflow safe enough to operate.

A trusted identity does not make every action trustworthy

Consider an agent asked to investigate an invoice discrepancy. It might read an email, retrieve an account record and propose a correction. Each step introduces a different question.

Who authorized the investigation? Is the agent acting for a user or through its own application identity? Should the same tool be allowed to read an invoice and issue a refund? What happens if the email includes instructions that try to redirect the agent?

This is an illustrative architecture problem, not a promise that any single control solves it. Authentication establishes an identity. Authorization must still constrain what that identity can do. Information retrieved from outside the application’s trusted instructions should not become authority merely because a model can read it.

The Zero Trust principle remains familiar: never trust, always verify. The work is deciding what verification means when software interprets information and chooses its next action.

What we will cover

The course begins with Zero Trust fundamentals: the principles behind the approach, the responsibilities involved in adoption and the difference between an architecture and a product carrying the label. That foundation matters before introducing AI-specific terminology.

We then examine how generative AI and autonomous agents change the security picture. The focus is on recognizing gaps across people, devices, applications, data and networks, rather than treating AI security as an isolated model setting. Group discussion gives us a way to reason through vulnerabilities in enterprise scenarios.

Next, we connect those risks to established guidance. NIST and CISA provide Zero Trust architecture and maturity perspectives. MITRE ATLAS contributes an adversary-oriented view of threats to AI systems. The OWASP Top 10 for LLMs helps organize common application risks. These resources serve different purposes; the useful skill is knowing how to apply them together, not collecting framework names.

An exercise maps AI risks to Zero Trust pillars. The goal is to turn a concern such as excessive access or unsafe handling of model inputs into a concrete conversation about controls, ownership and evidence.

We also consider the other side of the relationship: using AI to improve Zero Trust. Contextual decision-making, anomaly detection and threat intelligence can support security operations. They still need appropriate oversight, reliable inputs and a clear understanding of what an automated decision is allowed to change.

What you should take back to your team

The intended outcome is a more structured way to evaluate an AI initiative. You should be better prepared to identify the responsibilities behind Zero Trust adoption, recognize security gaps introduced by AI workflows and connect those gaps to controls that protect enterprise resources.

That makes this course particularly relevant to security architects, system architects and people responsible for integrating generative AI and agents across an organization.

You do not need to arrive as an AI researcher. You should be comfortable with basic security concepts such as authentication, authorization, networking and cloud computing, and have some familiarity with how AI systems fit into applications.

Build the security model alongside the AI capability

The time to ask what an agent may access is before connecting it to sensitive data. The time to define its authority is before it can take consequential action.

If those decisions are on your roadmap, join me for Zero Trust for AI Systems. Bring your architecture questions and use the live discussion to sharpen how you approach them.

View the course and registration options on O’Reilly.

For the longer-term course reference, see the course archive. The course details above show the next scheduled session when one is available.