The Agent Access Model
15:00 · August 5, 2026 · Cloudflare AI Blog
The Agent Access Model proposes a new architecture to secure task-scoped agents using strict identity brokering, continuous mediation, and stateful trust.
Summary
The Agent Access Model (AAM) adapts Zero Trust principles to the distinct requirements of AI agents. Where BeyondCorp and subsequent Zero Trust frameworks treat a human user and device as the principal, AAM treats each task-scoped agent run as the unit of authorization. An agent run is ephemeral, ends when its work completes, and operates at machine speed, often across multiple systems and delegation hops. The model therefore replaces durable service-account credentials and human-paced review cycles with controls that shrink the agent's capability set from the outset and enforce reductions in real time.
AAM rests on a single rule: do not trust the run. Every action is evaluated against the agent's identity, the declared task, and the accumulating state of the task execution graph. That state can only narrow remaining permissions. The architecture implements this rule through four active controls. An Agent Identity Broker issues short-lived, sender-constrained credentials that encode the specific task and principal and that expire with the task. A Task-Scoped Access Engine evaluates each request against the intersection of the approved task template, the initiating principal's authority, and current policy, denying anything outside that envelope. A Mediation Layer intercepts tool calls inside the harness and network traffic at the deployment boundary, applying policy at the point of action rather than through prompt instructions. A Trust Ratchet removes capabilities once declared protected events occur; removed authority returns only with a newly authorized task.
Two supporting systems operate on the evidence these controls produce. The Agent Activity Log captures the sequence of authorized and denied actions. The Grant Review Loop uses that record to propose refinements to task templates, which are then applied only to future dispatches. Together the components address the central shortcomings of existing controls: credentials that outlive their tasks, anomaly detection too slow for machine-speed exfiltration, unenforceable prompt-level boundaries, and loss of attribution across multi-hop delegation. The result is least-privilege enforcement that remains practical for large populations of short-lived agents while preserving auditability.
Why it matters
Highly actionable reference architecture for Dutch security teams deploying AI agents under GDPR, EU AI Act, and national ethical-AI guidelines; addresses real enterprise risks with concrete controls that can be implemented on existing OAuth/DPoP/MCP standards.
