# The Agent Access Model: Next Evolution of Zero Trust Security framework designed for ephemeral software agents - **Source:** [Cloudflare Blog](https://blog.cloudflare.com) - **Published:** 2026-08-05 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/5dbfd603-0b84-4f40-b7c1-2b116a1e4cec ## Limitations of traditional security models Over the past twelve years, enterprise security has shifted away from network trust models. With BeyondCorp, whether a request originates from within corporate perimeter or open internet no longer determines access. Instead, identity and device health became key. However, this model was designed for human users, not suited for the speed and transient nature of software agents that now permeate enterprise systems. ## The rise of software agents Modern organizations increasingly deploy software agents that act, decide, and access systems on our behalf. A task-scoped agent run is ephemeral - it terminates when its work completes. Long-lived agent services may handle multiple tasks and move data orders of magnitude faster than humans. Current human-centric controls fail quietly when applied to these agents, often granting excessive privileges. ## Why current controls fall short Traditional security controls weren't designed for agents. They create problems like overprivileging, insufficient visibility, and prolonged trust. For instance, long-lived credentials mismatch short-lived agent tasks. Anomaly detection and data loss prevention systems tuned for human speed can't keep pace with machine-speed agents. These gaps create vulnerabilities in modern enterprise environments. ## Introducing the Agent Access Model (AAM) AAM extends BeyondCorp's philosophy by removing implicit trust from the task execution graph. Its core rule: 'Don't trust the run. Authorize every action against the task and its accumulated state.' In this model, authorization for one action doesn't carry to the next. Each action is evaluated against three factors: agent identity, authorized task, and policy-relevant resources the graph has previously accessed. ## The capability reduction approach While most current work focuses on making access decisions smarter, AAM takes a different path: shrinking the agent's capability set so there's less to judge initially. Similar to Google's Beyond Zero, it reduces trust boundaries from applications to individual actions, making decisions at machine speed. This requires placing reasoning engines behind each authorization decision while strictly bounding their capability scope. ## Task execution graph concept In AAM, an agent is defined as one task-scoped run. The 'task execution graph' encompasses all work governed by the same capability ceiling and trust level. The same harness solving different tasks, consuming different events, or running on future schedules creates new graphs. A single human instruction may dispatch one or multiple such tasks across various systems. ## The multi-hop delegation challenge Current primitives handle single delegation hops better than multi-hop chains involving multiple humans. An agent might invoke a tool that calls another agent, which then accesses APIs on the original human's behalf. Somewhere in this chain, answers to 'who is this for and what are they allowed to do?' can get lost. AAM specifically addresses this authority composition problem across multiple hops. ## New positioning for preventive controls Anomaly detection and data loss prevention systems tuned for human activity may react too slowly for agents. An agent with database access and network connectivity could exfiltrate data before human-speed controls complete sampling. Therefore, preventive controls must run inline at the action point. AAM enforces boundaries at the harness mediating tool calls and network layer mediating packets - boundaries that can't be bypassed through prompt engineering. ## The credential lifetime mismatch Service accounts were designed for long-lived software like payroll systems or nightly batches, typically featuring long-lived keys, broad scopes, and infrequent rotation. When applied to short-lived agents, these credentials outlive their intended purpose, persisting in memory, logs, or environment variables where they might be replayed. AAM aligns credential lifetime with task duration - often just minutes for agent tasks. ## Implementation example: Ledger reconciliation When a human instructs 'reconcile these two ledgers,' it may trigger multiple agent tasks. Each might need access to databases, source control, logs, ticketing systems, knowledge bases, or spreadsheets. The task may require broad access - immediately, just for this task, and ideally not a second longer. AAM ensures the agent has precisely enough authority to complete its task and no more, implementing true least privilege at machine speed. ## Real-time privilege management The principle of least privilege is as old as access control itself. What changes is the enforcement frequency and speed. For human workforces, least privilege often means quarterly policy reviews. For large populations of short-lived agents, it requires real-time systems leaving audit trails. AAM centers this requirement, enabling continuous authorization that adapts to the agent's evolving task context. ## Industry impact and future outlook The Agent Access Model is gaining rapid adoption in high-security sectors like finance, healthcare, and cloud services. According to Gartner, enterprise agent usage will grow 300% by 2025. This growth makes AAM-like approaches essential as traditional security models prove inadequate for agents. The model's success could shape the next evolution of zero trust architectures, particularly in environments where autonomous agents increasingly mediate access to critical systems. ## Sources covering this story - https://blog.cloudflare.com/the-agent-access-model/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._