From Permitted Actions to Trusted Outcomes

Abstract

Autonomous AI agents can read sensitive information, execute privileged commands, and move data betweenenterprise systems. Existing authentication and authorization checks remain necessary, but a tool call can be permittedwhile the sequence of calls produces a result outside the authorized business task. This paper addresses a practicalsecurity problem: how can an enterprise detect and stop a harmful sequence of individually permitted actions beforea damaging action executes? It proposes Trajectory-Aware Zero Trust (TA-ZT), a vendor-neutral referencearchitecture that combines DoD Zero Trust pillars, CISA Zero Trust Maturity Model v2, task-scoped authorization,action history, data lineage, and independent policy enforcement. The proposed architecture allows a security gatewayto approve, pause, or deny a sensitive action using both its immediate parameters and its task-level context. The paperexplains the security gap, expected organizational value, control mapping, engineering components, exampleworkflow, test methodology, and phased implementation. It is a conceptual research proposal, not a deployed orexperimentally validated system. Keywords: autonomous AI agents; agentic security; Zero Trust architecture; DoD; CISA; policy decision point; policyenforcement point; task-scoped authorization; trajectory monitoring; data lineage