--- title: "Zero trust: definition | KYA glossary" url: https://knowyouragent.ch/en/knowledge/glossary/zero-trust lang: en updated: 2026-10-12 license: © Innopulse Consulting GmbH --- # Zero trust Zero trust is a security model that trusts no request on the basis of its network location alone but checks every request individually based on identity, context and rules. Classic security concepts trust everything inside one's own network. Zero trust abandons this: every request, whether from inside or outside, is authenticated, authorized and executed with as few rights as possible. NIST described the model in 2020 in publication SP 800-207, with the policy decision point and policy enforcement point as core building blocks. Zero trust fits AI agents particularly well. An agent can be manipulated even if it runs in one's own network. Every one of its actions should therefore be checked individually, against the instruction it actually has. ## Example A company runs an agent in its own data center. Nevertheless, the gateway checks each of its requests to the accounting system: the agent's identity through its workload identity, the action against the mandate, the decision service's decision. Location in the network alone opens nothing. ## How it differs Zero trust is an architecture principle; least privilege is a principle within it. An [agent mandate](https://knowyouragent.ch/en/knowledge/glossary/agent-mandate) carries zero trust to the level of individual actions on someone's behalf. ## In practice - Check every action of an agent individually, even if it runs in your own network. - Give agents their own identity instead of shared access. - Combine zero trust at the network and application level with mandates for the individual action. ## Role in KYA KYA follows the same idea: nothing counts as proven just because it is claimed or comes from a trusted environment. Embedded keys are self-asserted; only an anchor from the [verifying party](https://knowyouragent.ch/en/knowledge/glossary/verifying-party) turns them into proof. A term from the flow, not a check of its own. [To the method](https://knowyouragent.ch/en/method) [Verify now: open a matching example](https://knowyouragent.ch/en/verify?beispiel=paket) ## Frequently asked questions ### What does zero trust mean? No request is trusted on the basis of its network location alone. Each is checked individually based on identity, context and rules and executed with as few rights as possible. ### Who defined zero trust? The concept emerged in industry; NIST described it as an architecture in 2020 in publication SP 800-207. ### Why does zero trust fit AI agents? Because agents can be manipulated even if they run in one's own network. Checking every action individually limits the damage. ### Is zero trust a product? No. Zero trust is an architecture principle that can be implemented with various building blocks, such as identities, gateways and decision services. ### How does zero trust relate to KYA? KYA applies the idea to evidence: self-asserted details do not count as proven, and every action is checked against its mandate. ## Sources - [NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final) ## Related terms - [Policy decision point (PDP)](https://knowyouragent.ch/en/knowledge/glossary/policy-decision-point) - [Least privilege](https://knowyouragent.ch/en/knowledge/glossary/least-privilege) - [Workload identity (SPIFFE)](https://knowyouragent.ch/en/knowledge/glossary/workload-identity) - [Mutual TLS (RFC 8705)](https://knowyouragent.ch/en/knowledge/glossary/mutual-tls) --- Quelle: https://knowyouragent.ch/en/knowledge/glossary/zero-trust · KYA – Know Your Agent