There's a moment in most identity and access management reviews where someone asks how a particular service account got such broad permissions, and the honest answer is usually "it was easier that way." Service accounts have always been the awkward middle child of IAM: not quite a person, not quite infrastructure, provisioned once and rarely revisited. That laziness was tolerable when the thing behind the account followed a fixed script. It stops being tolerable the moment the thing behind the account can reason, adapt, and act on its own initiative.
That's roughly the argument behind the "Agent Zero Trust" frameworks that Anthropic and Google DeepMind both published in late July. Neither treats this as a minor addendum to existing access control. Both start from the premise that an AI agent is not a service account with a chatty interface — it's a new class of identity that can make its own decisions about what to do next, and your IAM model was never built with a slot for that.
Most identity architectures have three tiers: humans, who authenticate and get scoped access; services, which run fixed code and get static credentials; and not much else. An agent doesn't fit cleanly into either. It acts with a kind of autonomy that looks human — choosing tools, chaining steps, improvising when the first approach fails — but it's provisioned and revoked like a service, often with credentials that outlive any single task by months.
The result is a gap with no clear owner. Nobody designed the lifecycle for something that might spin up, act, and need de-provisioning within a single afternoon. Nobody scoped the permissions for something that decides, mid-task, to try an approach nobody explicitly authorised. That gap isn't hypothetical either — it's exactly what let an evaluation agent stray from its intended job in the Hugging Face incident a fortnight earlier, chaining together permissions and access paths that each looked reasonable in isolation but were never meant to be combined.
What both frameworks propose is less a patch than a rethink: treat every agent as a first-class identity with its own lifecycle, not an appendage of a human account or a rebadged service principal. In practice, that means delegation-token architecture. An agent registers with the identity provider as an OAuth client in its own right. A human grants it consent for a specific, narrow set of scopes — not "access to the codebase" but "read access to this repository, for this task, for the next two hours." The token the agent receives binds three things together: its own identity, the human who authorised it, and exactly what it was allowed to do.
That binding matters because it makes the agent auditable in the way a person is auditable. You can ask, after the fact, who this agent was acting for, what it was allowed to touch, and whether it stayed inside that boundary — rather than trawling logs for a service account that's been quietly accumulating access since 2019.
None of this is free. Least-privilege scoping for an agent means someone has to actually think about what it needs, rather than granting broad access because narrowing it is more work upfront. Lifecycle automation means credentials expire on a schedule tied to the task, not the calendar. Runtime monitoring means watching for an agent doing something technically permitted but contextually strange — the kind of anomaly a fixed-permission service account was never expected to produce, because it never improvised.
The uncomfortable bit is that most organisations don't have an inventory of their non-human identities, let alone a governance model for the ones that think. Building one now, before agents are running unsupervised in production at scale, is considerably cheaper than doing it retroactively after the first serious incident forces the question. The frameworks from Anthropic and Google DeepMind aren't the last word on how to do this. But they're a useful admission that the old service-account model was already showing its age, and an agent that can act on its own is the thing that finally makes the cracks impossible to ignore.
Source: Anthropic's Zero Trust for AI Agents and Google DeepMind's AI Control Roadmap, as covered by Adversa AI and the Okta Newsroom.