Anthropic's Zero Trust Framework for AI Agents: Eight Implementation Phases

Anthropic published a practical Zero Trust security framework for AI agents: an eight-phase implementation guide covering credential scoping, action gates, and incident response for teams running Claude Code or custom agent pipelines in production.

Zero Trust for AI agents (published July 23) extends classic Zero Trust principles — never trust by default, verify every action, assume potential compromise — to the specifics of agentic systems that can read files, call APIs, and write code. The three additions that matter most for engineers:

Per-session scoped credentials. Each agent run gets time-limited, task-scoped credentials rather than long-lived service account tokens. An agent given S3 read access for task A should not inherit that access when repurposed for task B.

Action gates for high-impact operations. File writes, deploys, and external API calls pass through an approval layer even in auto mode. This complements Claude Code's existing --allowlist-file permission model — the framework gives a principled way to decide what goes on that list.

Agentic SOAR. Structured agent activity logs feed a security orchestration layer that can automatically quarantine a session showing anomalous tool-call patterns — flagging prompt-injection pivots without waiting for a human reviewer.

The eight-phase implementation workflow walks from "no guardrails" to full agentic Zero Trust gradually — useful given that most teams can't rebuild their auth stack overnight.

Why it matters: As agents run longer, touch more tools, and operate without constant human supervision, the attack surface from prompt injection, confused-deputy exploits, and overprivileged credentials widens. This is the most complete published treatment of how to contain it — and it comes from the team building Claude Code.

Sources: Zero Trust for AI agents — claude.com · Data-layer analysis — Securiti.ai · Enforcement guide — Varonis