Definition
Applying the security principle 'never trust, always verify' to AI agents: rather than granting an AI agent broad standing permissions, every action it attempts is verified in real time against the least access needed for that specific task. No agent is trusted by default, even if it previously behaved correctly.
Why it matters
Traditional identity and access systems were designed for human users who log in once per session. AI agents act continuously, at machine speed, across dozens of tools. Without real-time, per-action authorisation, a single compromised agent can cause far more damage far faster than a compromised human account.