By James Yang, Executive Assistant to the CEO, Profet AI
Seven Capability Domains, Three Maturity Tiers: A Completely Different Approach to Defense
After finishing the previous article, if you are calculating which tool to buy to address each type of threat, pause for a moment. The mindset of patching vulnerabilities one by one could barely keep pace back in the era of human attackers. Now that attackers are also using AI agents, new attack techniques are emerging faster than security teams can patch them. This article is about switching to a completely different defense logic.
Zero Trust as a concept traces back to 1994, when Stephen Paul Marsh first systematically proposed it in his doctoral dissertation at the University of Stirling. NIST formally established concrete guidance with SP 800-207 in 2020. In its report “Zero Trust for AI Agents,” Anthropic applies this framework to the entirely new attack surface of agentic AI, proposing seven capability domains detailed down to an executable level.
One Principle, Three Tenets
The core logic of Zero Trust, in one sentence: trust nothing and no one, verify every access request, and assume a breach has already occurred. Expanded, this becomes three tenets:
• Never trust, always verify: Every access request must be authenticated and authorized, regardless of whether it originates from inside the corporate network.
• Assume breach: Systems should be designed on the assumption that intrusion will eventually happen. The focus is not on preventing intrusion, but on limiting the damage an attacker can do once inside.
• Least privilege: Grant only the minimum access needed to complete a task, so that any single breach is contained to a small blast radius.
More important than the principles themselves is a litmus test: does this control make an attack impossible, or does it merely make the attack more inconvenient? Defenses that rely on “adding friction”, extra jump boxes, rate limiting, non-standard ports, lose most of their effectiveness against automated attackers whose cost per attempt approaches zero. Controls that actually hold up share a common trait: hardware-bound credentials, tokens that expire, cryptographic identities, and network paths that simply do not exist. This litmus test runs through all seven capability domains described below.
Three Maturity Tiers: A Growth Path, Not Three Options
Anthropic breaks each capability domain into three tiers: Foundation, Enterprise, and Advanced. Enterprise builds on Foundation, and Advanced builds on Enterprise, each tier reinforcing existing controls layer by layer rather than starting over. Foundation is the entry point into Zero Trust. Enterprise is the target level most organizations of a certain size should aim for. Advanced is designed for heavily regulated industries, national security applications, or deployments where the consequences of failure are severe.
Worth noting: because of the compressed attack speed discussed in the previous article, the bar for Foundation itself has been raised. Practices once considered a reasonable starting point, such as managing risk through API key rotation, no longer qualify. Short-lived tokens, cryptographically rooted identities, identity-based isolation, and automated frontline alert triage are now baseline requirements, not advanced options.
Seven Capability Domains: A Complete Chain from Foundation to Governance
Agent Identity and Authentication
Identity and authentication form the foundation underlying all other capabilities. Without a verifiable identity, access control cannot be enforced, and behavior cannot be attributed to a specific agent. The path runs from cryptographically rooted persistent identity, to certificate-based authentication paired with lifecycle management, and ultimately to hardware-bound identity, where credentials are stored in a hardware security module and integrity is verified through remote attestation.
Once identity is established, an agent must prove its identity again every time it accesses a service. This is service authentication. The path runs from short-lived tokens measured in minutes, to mutual TLS with certificate pinning, and ultimately to hardware-bound credentials. Managing risk through API key rotation is no longer sufficient, because credentials that can be extracted from a codebase do not become meaningfully harder to steal no matter how often they are rotated.
Access Control and Privilege Management
An agent with legitimate permissions has a genuine identity. The problem is what it does once authorized. The path runs from role-based access control with default deny, to attribute-based access control that factors in context such as time, location, and risk score, and ultimately to real-time authorization that is re-evaluated for every single action. OWASP’s concept of Least Agency extends least privilege to cover what each tool is allowed to do, how often, and where, for example limiting a database tool to read-only queries.
It is worth being precise about the difference between RBAC and ABAC. RBAC (role-based access control) only looks at what role an agent holds. Once a role is assigned, its scope of permissions is fixed, and every agent under that role has identical access regardless of context. ABAC (attribute-based access control) goes further and factors in the context of the request itself, such as time, location, data sensitivity, and risk score. Two agents may both be customer service agents, but one querying general customer data during normal hours will be allowed through, while the same agent pulling large volumes of highly sensitive data late at night may be denied or asked for additional verification. Moving from RBAC to ABAC is essentially upgrading from a static judgment of “who you are” to a dynamic judgment of “what you are doing right now and how risky it is.” This is the single most important upgrade in moving from Foundation to Enterprise.
While the permission model decides whether access should be granted at all, the scope of that access determines when and for how long it can be exercised. Static permissions, once granted, persist indefinitely, remaining active even after the task is finished and creating long-term exposure. Dynamic permissions are elevated only for the duration of task execution and are withdrawn immediately afterward. The strictest form, just-in-time and just-enough access (JIT/JEA), compresses even the act of elevation to nearly the moment of use, granting access only at the instant it is actually needed and automatically revoking it on timeout or task completion, leaving no residual access behind. Last is the boundary of resources: identity-based isolation as the primary control, supplemented by network segmentation, progressing to containerized sandboxing, and ultimately to hardware isolation. For agents that process untrusted input, sandboxed execution is standard practice, not optional.
Observability and Auditing
Access control determines what gets blocked. Observability determines what actually happened. Logging progresses from complete records with timestamps, to tamper-evident audit trails, and ultimately to real-time streaming into a centralized monitoring platform. But before chasing the specifications of all three tiers, it is worth first establishing measurement for two metrics: dwell time (the interval between an anomaly occurring and a human noticing it) and coverage (the proportion of alerts that are actually investigated). These are the two metrics where AI automation delivers the greatest leverage.
Traceability is a separate dimension: generating a unique identifier for each request that follows it through every subsequent action, progressing to distributed tracing across multi-agent workflows, and ultimately to a complete provenance chain that supports replaying the full decision history. Logging answers “what happened.” Traceability answers “why it happened.”
Behavioral Monitoring and Response
Behavioral monitoring has to judge whether a given behavior is normal or suspicious, which requires an established baseline before anomalies can be identified. Baselines progress from being manually defined, to automatically learned statistical baselines, and ultimately to baselines that continuously update and can detect slow, gradual drift. This tier specifically addresses techniques such as long-term memory drift. Anomaly detection progresses from threshold-based alerts, to statistical methods, and ultimately to machine learning models that incorporate contextual information.
Once an anomaly is detected, response speed is what actually determines the extent of the damage. The division of labor is clear: automation handles the paperwork, logging, evidence collection, and drafting initial reports, while decisions about containment, disclosure, and customer communication remain with humans. Response capability itself also progresses through three tiers: alerts routed to the security team with a triage agent producing an initial assessment, progressing to automated execution of containment actions, and ultimately to agentic SOAR capable of coordinating containment across multiple systems. What automation should do is free up human response time, not replace final judgment.
Input Validation and Output Controls
This domain is the direct countermeasure to indirect prompt injection. On the input side, the path runs from basic format validation, to content filtering that screens out encoded payloads and suspicious instructions, and ultimately to multi-layer validation combining AI classifiers with content boundary markers. SQL injection has well-defined attack patterns that can be defended against, but agent input is free-form and unpredictable, so rule-based defense alone is not enough.
The output side guards against data exfiltration: progressing from scanning for sensitive patterns, to analyzing the semantics of output to identify social engineering risk, and ultimately to requiring human approval for high-risk actions. Input validation prevents malicious manipulation. Output control prevents data leakage. Both are essential.
Integrity and Recovery
When every other defense fails and a breach actually occurs, attackers often turn to tampering with the agent’s own configuration. The path runs from version control, to cryptographic signing, and ultimately to immutable infrastructure, where configurations are never modified but wholesale replaced, with image integrity verified before execution.
One practice runs counter to intuition: for components where risk is acceptable, enabling automatic updates is actually safer than insisting on manual approval, because the delay inherent in manual approval is itself a risk. The solution is to let automatic updates coexist with pre-deployment signature verification: signed updates flow through automatically, while unsigned changes are rejected outright. Recovery follows a similar path, from documented rollback procedures, to automated rollback, and ultimately to self-healing systems. No amount of automation can save a situation that cannot reliably roll back to a known good state.
AI Governance Policies
Technical controls can only enforce what governance policy defines. The path runs from a documented acceptable use policy, to a cross-functional governance framework that includes security, legal, and business stakeholders, and ultimately to embedding policy checks into the deployment pipeline itself, automatically detecting violations. Shadow AI, meaning employees using LLM tools on their own without approval, bypasses every one of the controls described above. This is the reality governance has to confront.
Seven Capability Domains: A Complete Chain from Foundation to Governance
Having gone through the seven capability domains, you do not need to redesign your defenses for every new attack technique that emerges. What you need to do is check where your enterprise’s existing agent deployments stand across these seven areas. Identity makes attribution and access control possible. Observability reveals what actually happened. Behavioral monitoring detects anomalies. Input and output controls intercept attacks at the boundary. Integrity makes recovery possible. Skip any one of these areas, and that is the gap attackers will come through.
The next article moves from framework to implementation: a concrete operational workflow, and how defense teams can accelerate their security operations to keep pace now that attack speed has compressed to a matter of hours.
