Mutual TLS plus workload identity can block lateral movement between AI agents and tools. Build both step by step in this guide. Read now.
Why agent networks break traditional perimeter security
AI agents do not behave like single-user clients. One agent may call another, invoke tools, read shared state, and hand off tasks without a human in the loop. If those hops trust a shared network, a shared API key, or a single service account, a compromised agent can move sideways into tools and data it was never meant to reach. Zero-trust for agents starts from a simple rule: every call is untrusted until the caller proves who it is, and every callee decides whether that identity is allowed to use that action right now.
Mutual TLS and workload identity work together here. mTLS proves the machine identity of the caller and encrypts the channel. Access control then maps that identity to least-privilege permissions for specific tools, scopes, and operations. Either piece alone is incomplete: encryption without authorization still lets a valid peer do too much, and authorization without strong identity is only as strong as a secret that can be copied.
Build mutual TLS between agents and tools
Start by treating each agent and each tool as a workload with its own certificate, issued by a private certificate authority you control. Prefer short-lived certificates and automate rotation so stolen credentials expire quickly. Require mTLS on every internal hop: agent-to-agent, agent-to-tool gateway, and tool-to-downstream service. Reject connections that present no client certificate, present an untrusted issuer, or fail hostname or SPIFFE-style identity checks against the expected peer.
Keep private keys out of application code. Load them from a secrets manager, a workload identity platform, or an agent that never exposes them to the model context. Log certificate subject, serial, and peer identity on success and failure so you can audit who connected, not only which IP was used. When you terminate TLS at a gateway, re-establish mTLS or an equivalent identity proof to the backend so the original caller identity is not dropped at the edge.
Add workload identity and least-privilege access control
Certificates answer “who is calling.” Access control answers “what may they do.” Map each workload identity to a small set of capabilities: which tools it may invoke, which methods, which resource scopes, and which rate or concurrency limits apply. Prefer explicit allow lists over broad roles. Separate identities for planning agents, execution agents, and admin tooling so a breach in one path cannot inherit rights from another.
- Authorize on identity plus action plus resource, not only on “is this a valid agent.”
- Deny by default for new tools and new agents until policy is reviewed.
- Bind high-risk operations (write, delete, external send) to stronger checks or human approval gates.
- Rotate credentials and revoke certificates as first-class incident steps, not afterthoughts.
Where agents call tools through a single gateway, enforce policy at the gateway with the verified mTLS identity as the principal. Pass only the claims the tool needs; do not forward raw credentials that would let the tool impersonate the agent elsewhere. Keep policy close to the enforcement point so it cannot be bypassed by calling a tool’s private port directly.
Roll out without breaking running agents
Introduce mTLS in stages: dual-run optional client certs, then required certs on non-critical paths, then required everywhere. Add access policies in shadow mode first—log would-deny decisions—then enforce. Monitor failed handshakes, certificate expiry, and authorization denials as product health signals, not only security noise. Document how a new agent gets a certificate, how a tool is registered, and how to revoke both under incident pressure.
Zero-trust for AI agents is not a single product checkbox. It is a repeatable pattern: strong peer authentication on every hop, short-lived workload identity, and narrow permissions for every tool call. Built that way, lateral movement between agents and tools stops being the default path and becomes something your system is designed to refuse.