Agentic-ZTA: A Multi-Agent Architecture for Autonomous Zero Trust Enforcement

Shovan Roy; Lopamudra Praharaj; Maanak Gupta; Bhavani Thuraisingham

cs.AIOct 5, 2026

Agentic-ZTA: A Multi-Agent Architecture for Autonomous Zero Trust Enforcement

Authors: Shovan Roy, Lopamudra Praharaj, Maanak Gupta, Bhavani Thuraisingham

Organizations: Department of Computer Science, Tennessee Tech University, Cookeville, TN, USA · Department of Computer Science, University of North Carolina Pembroke, Pembroke, NC, USA · Department of Computer Science, The University of Texas at Dallas, Richardson, Texas, USA

Abstract

Agentic AI is emerging as a promising paradigm for automating complex cybersecurity decisions, yet its use in enforcing zero trust introduces significant challenges in safety, reliability, and policy compliance. This paper presents Agentic AI based zero trust architecture (Agentic-ZTA) that operationalizes the NIST SP 800-207 ZTA architecture control loop through coordinated multi- agent decision pipeline. In the proposed framework, policy knowledge is embedded into a retrieval-augmented generation pipeline and retrieved at inference time as top-k relevant policies. Access requests are intercepted by the Policy Enforcement Point (PEP), enriched with contextual metadata. The request context is routed to a policy engine agent which invokes domain-specialized core agents first followed by supporting agents, if further evaluation needed. AI agents reason over access context, policy constraints and determine trust. The retrieved policies are embedded into agent prompt during inference time and agentic trust scores are aggregated and evaluated by a trust-algorithm, producing the final access decision for enforcement under continuous verification. We implement Agentic-ZTA in a testbed and evaluate it on representative access-control use cases scenarios. Our Agentic-ZTA framework achieves 95.0% accuracy, 93.9% precision, and 96.3% recall, and demonstrate the feasibility of enforcing zero trust using AI agents.

Figures & tables

Work	ZTA	MA	LLM	Trust	Enf.	Impl.
Ameer [ 3 ]	$\circ$	–	–	$\circ$	–	–
Ameer [ 4 ]	+	–	–	$\circ$	–	$\circ$
Chandramouli [ 13 ]	+	–	–	–	–	–
Borchert [ borchert2025implementing ]	+	–	–	–	–	$\circ$
Lewis [ 28 ]	–	–	+	–	–	–
Cardoso & Ferrando [ 12 ]	–	+	–	–	$\circ$	–

Table 1: Comparison of Related Work Against Agentic-ZTA

Figure 1: Agentic-ZTA architecture. The PE agent serves as the orchestrator within the NIST ZTA Policy Decision Point (PDP), invoking core agents, querying supporting agents upon initial clearance, and synthesizing their evaluations via the trust algorithm. The PEP subsequently enforces the access control decision.

Figure 2: Agentic-ZTA access control workflow. Subject need access to a resource. The PEP normalizes and forwards each request. The request is embedded and top-k matched policies are retrieved. Access request is sent to PE agent for evaluation, which invokes core agents first then supporting agents when no core agent Deny . Decision is enforced under continuous verification.

Figure 3: Five-zone IoBT coalition testbed topology. Zone gateways act as distributed PEPs and forward all access requests to the PE Agent at the Shared Data Fabric.

Agent	$d_{i}$	$s_{i}$	$c_{i}$	Decision
IAM	0	1.0	0.95	ALLOW
Threat Detection	0	1.0	0.70	ALLOW
CDM	0	1.0	0.70	ALLOW
Data Access Policy	0	1.0	0.95	ALLOW

Table 2: Per-Agent Assessment for Use Case 1

Agent	$d_{i}$	$s_{i}$	$c_{i}$	Decision
PKI	0	1.0	0.85	ALLOW
IAM	1	0.0	0.60	DENY

Table 3: Per-Agent Assessment for Use Case 2

Figure 4: Agentic actions executed by the PE Agent following the trust decision. On Allow , the PE Agent calls issue_access_token() , log_decision() and send_notification() tools. On Deny , it calls revoke_certificate() , quarantine_session() , log_decision() and send_notification() tools.

Figure 5: Confusion matrix for Agentic-ZTA on 160 access-request evaluation samples ( DENY = positive class).

Figure 6: ROC curve for Agentic-ZTA on the 160-sample access-request evaluation dataset. The operating point corresponds to the deployed decision threshold.

Trace	Phase(s)	Agent	Inference (s)	Model Load (s)
UC1	Core agent call	IAM	33.08	33.12
	Core agent call	Threat Detection	83.84	83.88
	Supporting agent call	CDM	50.27	50.31
	Supporting agent call	Data Access Policy	30.21	30.25
UC2	Core agent call	PKI	45.65	45.67
	Core agent call	IAM	24.49	24.51

Table 4: Per-Request Latency Breakdown (single-request traces).

Implementation	Evaluation time
Rule-based (deterministic)	0.0007 s
LLM-based (Agentic-ZTA, core phase only)	45.67 s
LLM-based (Agentic-ZTA, core + supporting phases)	134.32 s

Table 5: Latency Comparison: Rule-Based vs. LLM-Based Agentic-ZTA Access Request.

Batch Size ( $n$ )	Total Elapsed Time (s)	Throughput (req/min)
5	609.24	0.49
10	1217.92	0.49
20	2131.74	0.56
50	4947.34	0.61

Table 6: Load Test Results Across Concurrency Levels (

n

)

$k$	P@ $k$	R@ $k$	F1@ $k$	MRR@ $k$	nDCG@ $k$	Hit@ $k$
1	0.8571	0.8571	0.8571	0.8571	0.8571	0.8571
3	0.3333	1.0000	0.5000	0.9286	0.9473	1.0000
5	0.2000	1.0000	0.3333	0.9286	0.9473	1.0000
7	0.1429	1.0000	0.2500	0.9286	0.9473	1.0000

Table 7: Use Case 2 RAG retrieval quality across seven policy queries.

Explore similar work

Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking
Jul 31, 2026Yayu Gao, Yong Xiao, Hao Hu +5Trustworthy Artificial Intelligence AI Trustworthiness
School of Electronic Information and Communications, the Huazhong University of Science and Technology, Wuhan, China 430074 · Peng Cheng Laboratory, Shenzhen, China · Pazhou Laboratory (Huangpu), Guangzhou, China +4
Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
Aug 3, 2026Alireza Lotfi, Subangkar Karmaker Shanto, Imtiaz Karim +1Agentic Deployments Delegation
Purdue University · Department of Computer Science · West Lafayette, IN, USA +2
Hybrid Inspection and Task-Based Access Control in Zero-Trust Agentic AI
May 4, 2026Majed El Helou, Benjamin Ryder, Chiara Troiani +3Access Control Agentic Deployments
Cisco Systems, Switzerland

Jul 31, 2026, cs.CRJ/K move · Enter open · S save

Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking

Yayu Gao, Yong Xiao, Hao Hu, Xubo Li+4

School of Electronic Information and Communications, the Huazhong University of Science and Technology, Wuhan, China 430074 · Peng Cheng Laboratory, Shenzhen, China · Pazhou Laboratory (Huangpu), Guangzhou, China+4

Trustworthy Artificial Intelligence AI Trustworthiness Skills

Open paper AskPDF arXiv

Agentic AI networking (AgentNet) systems rely heavily on third-party skillset implementations and distributed multi-agent collaboration, yet they face major claim-to-capability inconsistencies and security vulnerabilities under trust-by-declaration assumptions. To bridge this gap, this paper proposes TrustAgentNet, a dual-tier blockchain-secured zero-trust framework. Specifically, a global Chain of Skillsets (CoS) governs the lifecycle of skillset metadata with protocols empowered by specialized agents to enforce off-chain auditing while maintaining lightweight on-chain cryptographic consensus. Furthermore, transient, task-oriented Chains of Collaboration (CoC) are dynamically established to enable trustless distributed multi-agent collaboration. Theoretical analysis of the three-way trade-off among security level, task performance, and resource overhead is provided and empirically validated. Experimental results on a hardware prototype demonstrate that compared with no-blockchain trust-by-default baselines, the zero-trust overhead of TrustAgentNet is dominated by off-chain inference, while the blockchain layer incurs minor ledger costs via the ledger-IPFS storage and on/off-chain integration design. Crucially, the proposed verification pipeline achieves a flawless 100% accuracy across 50 AI models, correctly validating 40 honest skillsets and intercepting 10 adversarial ones, and generalizes to non-AI domains with an 83.91% accuracy and a 0.85 F1-score across 1478 features from 171 ClawHub skills. Adversarial experiments further show that TrustAgentNet enables autonomous skillset self-recovery against various malicious attacks.

Abstract

Explore similar work

Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking

Securing Agentic AI: From Per-Action Checks to Trajectory Assurance

Hybrid Inspection and Task-Based Access Control in Zero-Trust Agentic AI