Zero Trust for AI Agents Must Follow the Action

South Korea extends zero trust to agentic AI

South Korea has published guidance applying zero-trust security principles to agentic AI.

The guidance places checks around tool calls, delegated tasks and external communications. It also proposes human approval or pre-approved policies according to the level of risk.

This reflects a practical change in how zero trust needs to operate: authenticating an AI agent establishes who or what has connected. It does not authorise every action the agent may later discover.

Trusting the session is no longer enough

Consider an assistant authorised to examine supplier invoices.

Access to the invoice system may allow it to read relevant records. That access should not automatically permit it to:

• Change a supplier’s bank details.
• Approve a payment.
• Export the records.
• Delegate the work to an external agent.
• Call a new financial service.

The connection may remain valid while the proposed action exceeds the available authority.

Zero trust for agentic systems therefore needs to continue after authentication. It must follow the agent as it selects tools, changes methods and proposes effects.

Delegation creates a new authority question

An agent may divide work among other agents or services.

That can improve efficiency, but the receiving agent should not automatically inherit every permission available to the original system.

Before a task is delegated, an organisation may need to establish:

• What information will accompany it.
• Which agent or service will receive it.
• The purpose of the delegation.
• Which tools the recipient may use.
• Whether the delegation can continue beyond the current task.
• Whether human approval is required.

Delegation changes the acting party. It should remain visible in both authority and evidence.

Pre-approved policy is not blanket permission

Pre-approved rules can allow routine, bounded actions to proceed without waiting for individual human approval.

That does not mean every action within the same workflow should receive the same treatment.

An agent might be permitted to retrieve an approved procedure automatically while being required to Step Up a proposed payment or external disclosure. A request involving an unknown destination or missing authority might need to be Denied or stopped.

Depending on the current context, PF Kernel could return Allow, Deny, Modify, Step Up or Stop the Line for the particular action.

Stopping one tool call would not require the entire agent or unrelated activity to be disabled.

Evidence must distinguish decision from effect

A useful operational record may need to connect:

• The agent, service and tool versions.
• The approved purpose and operating context.
• The proposed tool call, delegation or communication.
• The authority evaluation returned.
• Any modification, escalation or refusal.
• The instruction presented to the executing system.
• Trusted evidence of what that system accepted or changed.

An authority record cannot independently prove that a tool performed an action. Equally, a system log showing that an action occurred does not prove that the agent possessed the necessary authority.

Those records should be linked without being treated as interchangeable.

A bounded PF Systems exercise

A suitable first exercise would use synthetic information, controlled tools and simulated external services.

Representative scenarios could include:

• Retrieving an approved document.
• Delegating a summary task.
• Attempting to share restricted information.
• Invoking a tool beyond the agent’s permitted scope.
• Changing destination after refusal.
• Requesting a consequential action requiring human approval.

PF Memory could provide approved context without deciding or executing. PF Kernel could evaluate each proposed action. PF Core could preserve linked evidence of the captured governed evaluation.

Supported deterministic replay would concern that evaluation—not the probabilistic agent’s generation or automatic repetition of a tool action.

ClientBridge could connect the controlled services without inheriting PF Kernel’s authority. Proof Harness could qualify evidence against the defined exercise without certifying the system. PF Trace could display preserved evidence without manufacturing it.

The first commercial gate should remain discovery and demonstration, followed by a controlled shadow pilot with no live action.

South Korea’s guidance provides a clear international signal: for agentic AI, zero trust cannot end when access begins. It must continue through every consequential action.