Security & Threat Intelligence · 05.08.2026, 14:09 UTC
The Agent Access Model
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | Cloudflare Blog ↗ |
| Veröffentlicht | 05.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
For the last twelve years, enterprise security has moved away from trusting the network. BeyondCorp made the case that a request's origin, inside the corporate perimeter or on the open Internet, should not decide whether it is allowed. Identity and device health should. That model won: it now underpins much of Zero Trust.Google’s BeyondCorp assumed a specific principal: a human at a device, acting at human speed. Organizations are now deploying agents, software principals that reason, act, and reach into systems on our behalf. A task-scoped agent run is ephemeral. It ends when its work is done. A long-lived agent service may handle many such tasks and move data far faster than a person.The controls we built for humans do not fail loudly when we point them at agents. They fail quietly, by granting too much, seeing too little, and trusting for too long.This paper proposes an access model for agents: the Agent Access Model (AAM). We describe the model and show how its components can be built. We then walk through a concrete example and separate the single-principal controls available today from the harder problem of multiplayer access control.Much of the current work tries to make each access decision smarter. AAM takes a different approach: make the agent's capability smaller, so there is less to judge in the first place.The shiftA decade ago, the hard question in enterprise security was where is this request coming from, and do I trust that place? BeyondCorp's answer was that you should not trust the place at all. You authenticate the user, interrogate the device, and make …