ZERO TRUST FOR MCP-CONNECTED ENTERPRISE AI AGENTS

Abstract

Enterprise AI agents now read tickets, documents, and web pages and then act on what they find through tool protocols such as the Model Context Protocol (MCP). Because an agent combines untrusted input with delegated privileges, it creates a path from attacker-influenced content to privileged action that earlier Zero Trust programs did not anticipate. This article examines how the principles of NIST SP 800-207 should be extended for agents. It compares five approaches that organizations use to give agents access to enterprise systems, from shared API keys to task-scoped delegated tokens enforced at a gateway, and evaluates them against five attack classes: indirect prompt injection, tool poisoning, confused-deputy misuse, token theft and replay, and excessive agency. An exposure analysis of a representative service-desk agent shows that task-scoped, audience-bound, sender-constrained tokens reduce exposure by about five orders of magnitude compared with a shared key, while gateway mediation constrains what a hijacked agent can do with the access that remains. The article closes with an adoption roadmap and measures of progress.