The industry signal
Microsoft’s August 2026 guidance extends its Zero Trust discussion to AI agents and DevSecOps. The focus reflects an enterprise shift: autonomous software is becoming an active participant in business systems, rather than a passive interface. Microsoft: Zero Trust for AI, August 2026 ↗
Our reading: distinguish the investigator from the enforcer
An agent that can search network evidence does not need permanent authority to change network policy. Give investigation tools explicit scopes, bind every query to a tenant and a case, and retain the evidence used to support the result. Put consequential changes behind the organization’s approved change process.
Network data is also untrusted input. A URL, DNS label, certificate field, or captured payload can contain text intended to manipulate an assistant. The auditor should treat that text as evidence, never as a new instruction or a source of tool authority.
Evaluate the audit, not the fluency
| Question | Evidence to request |
|---|---|
| Can the finding be reproduced? | Source event identifiers and query scope. |
| Can the agent cross tenant boundaries? | Isolation tests and authorization enforcement. |
| Does it know what it cannot see? | Encrypted-traffic and missing-data evaluation cases. |
| Can it change policy? | Explicit tool authority and approval records. |
A useful pilot includes ambiguous cases and missing evidence. Correctly declining to conclude is preferable to a confident unsupported verdict.