The Agent Access Model (AAM) proposes a new security architecture for AI agents, extending Zero Trust principles from network location to individual task execution. Unlike human-oriented controls (SSO, device posture, session scoring), agents are ephemeral, act at machine speed, and compose authority across multiple hops — making existing controls a poor fit. AAM's five core principles: short-lived task-scoped credentials, enforcement in the harness and network (not the prompt), selective human oversight, evidence-based grant reviews, and a one-directional Trust Ratchet that can only narrow capabilities during a task. The reference architecture includes an Agent Identity Broker (using OAuth 2.0 Token Exchange and DPoP), a Task-Scoped Access Engine, a Mediation Layer, the Trust Ratchet, an Agent Activity Log, and a Grant Review Loop. A concrete example shows how a nightly reconciliation agent is protected from prompt-injection-driven data exfiltration. The paper also identifies multiplayer access control — where a single agent serves multiple principals with different permissions — as an unsolved open problem, citing research showing privacy-violation rates of 15–51% in enterprise LLM workflows.
