Abstract: Autonomous AI agents combine language-model reasoning with external data, persistent context, and privileged tools, creating attack paths in which adversarial content can redirect actions and misuse delegated authority. This paper proposes a zero-trust security architecture that treats inputs, agent identities, and tool requests as untrusted until independently verified, and enforces least-privilege, context-bound authorization at execution time. The architecture separates retrieved content from governing instructions and places deterministic policy checks, sandboxed execution, and auditable approval boundaries between agent plans and consequential actions. By making authority explicit and validating each action against policy and current context, the design aims to limit the impact of prompt injection and other manipulative inputs without relying solely on model-level safeguards.

REFERENCES

[1]. Z. Deng et al., “AI agents under threat: A survey of key security challenges and future pathways,” ACM Computing Surveys, vol. 57, no. 7, pp. 1–36, Feb. 2025, doi: 10.1145/3716628.

[2]. R. Haider, “From search visibility to answer share: Developing and testing a causal theory of brand discoverability and consumer conversion in generative engine optimization,” Jul. 2026, doi: 10.13140/rg.2.2.24339.64807.

[3]. R. Namboothiri, “Authorization-First retrieval: Enforcing least privilege in multi-agent RAG systems.” Institute of Electrical and Electronics Engineers (IEEE), Mar. 05, 2026. doi: 10.36227/techrxiv.177273889.98246164/v1.

[4]. R. Haider, “Attention sovereignty in digital markets: Designing and testing consumer-owned preference agents as an alternative to surveillance-based advertising,” Jul. 2026, doi: 10.13140/rg.2.2.27695.09125.

[5]. M. Mujeeb, “Permission escalation and prompt injection in autonomous AI agent systems: A layered threat analysis,” Zenodo (CERN European Organization for Nuclear Research). Apr. 30, 2026. doi: 10.5281/zenodo.19920653.

[6]. C. Bühler, M. Biagiola, L. Di Grazia, and G. Salvaneschi, “AgentBound: Securing execution boundaries of AI agents,” arXiv (Cornell University). Oct. 24, 2025. doi: 10.48550/arxiv.2510.21236.

[7]. T. Shi et al., “Progent: Securing AI agents with privilege control,” ArXiv.org. Apr. 16, 2025. doi: 10.48550/arxiv.2504.11703.

[8]. J. Zhu et al., “MiniScope: A least privilege framework for authorizing tool calling agents,” arXiv (Cornell University). Dec. 11, 2025. doi: 10.48550/arxiv.2512.11147.

[9]. Q. Zhan, R. Fang, H. S. Panchal, and D. Kang, “Adaptive attacks break defenses against indirect prompt injection attacks on LLM agents,” in Findings of the Association for Computational Linguistics: NAACL 2025, Stroudsburg, PA, USA: Association for Computational Linguistics, 2025, pp. 7101–7117. doi: 10.18653/v1/2025.findings-naacl.395.

[10]. Z. Wang et al., “AGENTVIGIL: Automatic black-box red-teaming for indirect prompt injection against LLM agents,” in Findings of the Association for Computational Linguistics: EMNLP 2025, Stroudsburg, PA, USA: Association for Computational Linguistics, 2025, pp. 23159–23172. doi: 10.18653/v1/2025.findings-emnlp.1258.

[11]. “European journal of prosthodontics and restorative dentistry,” May 2026, doi: 10.1922/ejprd.v34i. [12]. H. Kanaker, H. Fakhouri, N. A. Karim, M. Abuhamdeh, N. H. A. Ismail, and S. Fakhouri, “Securing tool-using AI agents against injection and authority misuse,” Computation, vol. 14, no. 5, p. 98, Apr. 2026, doi: 10.3390/computation14050098.

[13]. D. Hofer, E. Debenedetti, and F. Tramèr, “Assessing automated prompt injection attacks in agentic environments,” arXiv (Cornell University). Jun. 09, 2026. doi: 10.48550/arxiv.2606.10525.

[14]. R. Haider et al., “Forensic consumer psychology: An evidence-based framework for detecting deception and digital market manipulation,” 2026.

[15]. Y. Liu, Y. Zhao, Y. Lyu, T. Zhang, H. Wang, and D. Lo, “‘Your AI, my shell’: Demystifying prompt injection attacks on agentic AI coding editors,” arXiv (Cornell University). Sep. 26, 2025. doi: 10.48550/arxiv.2509.22040.

[16]. V. S. Narajala and O. Narayan, “Securing agentic AI: A comprehensive threat model and mitigation framework for generative AI agents,” in 2025 8th International Conference on Algorithms, Computing and Artificial Intelligence (ACAI), IEEE, Dec. 2025, pp. 1–6. doi: 10.1109/acai68217.2025.11406310.

[17]. P. Li et al., “AgentCanary: A security evaluation framework for autonomous AI agents in real executable environments,” arXiv (Cornell University). Jun. 09, 2026. doi: 10.48550/arxiv.2606.10484.

[18]. R. Haider, Md. R. Amin, Md. S. Arafat, I. Hossain, and R. Ahmad, “Smart Automation: Revolutionizing Business Operations, Advertising Costs and Customer Satisfaction Through Technology,” 2026.

[19]. Y. Gamage, “Indirect prompt injection in LLM agent frameworks: A comparative study,” Zenodo (CERN European Organization for Nuclear Research). Apr. 13, 2026. doi: 10.5281/zenodo.19558615.

[20]. V. K. P. Budigi, M. Dhanekula, S. C. Sirigiri, and S. R. Marri, “Zero-Trust identity for autonomous AI agents: Unifying SPIFFE, oauth 2.1 with PKCE, OIDC, and OPA in multi-agent architectures,” International Journal of Scientific Research in Computer Science Engineering and Information Technology, vol. 12, no. 3, pp. 328–340, May 2026, doi: 10.32628/cseit2612335.

[21]. K. Pappu, B. Bhushan, and A. Mittal, “SPIFFE-Based zero-trust authentication for AI agent ecosystems,” in 2025 International Conference on Computer and Applications (ICCA), IEEE, Dec. 2025, pp. 1–7. doi: 10.1109/icca66035.2025.11431026.

[22]. B. Bhushan, K. Pappu, V. Jadav, and N. Jaiswal, “Risk-Adaptive authorization for agentic AI systems,” in SoutheastCon 2026, IEEE, Feb. 2026, pp. 1–6. doi: 10.1109/southeastcon63549.2026.11476129.

[23]. M. Gaikwad, “The agentic trust fabric: A systematization of security architectures for autonomous AI agents.” Institute of Electrical and Electronics Engineers (IEEE), Nov. 27, 2025. doi: 10.36227/techrxiv.176422629.96159172/v1.

[24]. A. Goswami, “Agentic JWT: A secure delegation protocol for autonomous AI agents,” arXiv (Cornell University). Sep. 16, 2025. doi: 10.48550/arxiv.2509.13597.

[25]. RaiyanHaider, “Generative AI and quantum-inspired optimization: Redefining portfolio risk management and real-time capital allocation in volatile markets,” Journal of Informatics Education and Research, Mar. 2026, doi: 10.52783/jier.v6i1.4540.

[26]. R. Haider, T. Dwivedi, A. G. G. Girish, N. Verma, B. Kashyap, and V. S. Dubey, “Neuromarketing approaches to shaping healthy consumer choices: An integrative analysis of methods, efficacy, and ethical considerations,” CLOK (University of Central Lancashire), Mar. 2026, doi: 10.25258/ijddt.16.4s.62.

[27]. B. P. Singh, “Securing the boundary: Trust context separation in privileged AI agent systems,” Computer Fraud & Security, pp. 998–1009, Apr. 2026, doi: 10.52710/cfs.1012.

[28]. R. Haider, Md. F. I. Shaif, R. Ahmed, N. H. Nafi, M. R. Sumon, and M. Rahman, “Assessing the impact of influencer marketing on brand value and business revenue: An empirical and thematic analysis,” International Journal of Science and Research Archive, vol. 16, no. 2, pp. 471–482, Aug. 2025, doi: 10.30574/ijsra.2025.16.2.2355.

[29]. R. Haider, Md. F. I. Shaif, R. Ahmed, N. H. Nafi, M. R. Sumon, and M. Rahman, “The influence of social media branding on consumer purchase behavior: A comprehensive empirical and thematic analysis,” International Journal of Science and Research Archive, vol. 16, no. 2, pp. 460–470, Aug. 2025, doi: 10.30574/ijsra.2025.16.2.2354.

[30]. Z. Yan et al., “Do Coding Agents Understand Least-Privilege Authorization?,” ArXiv.org, 2026, [Online]. Available: https://arxiv.org/pdf/2605.14859

[31]. R. Haider, J. T. Juba, and S. Chowdhury, “Exploring the link between suicidal ideation and digital environments: The hidden impact of marketing content,” International Journal of Science and Research Archive, vol. 16, no. 2, pp. 607–614, Aug. 2025, doi: 10.30574/ijsra.2025.16.2.2353.

[32]. R. Ledan, “The capability-container pattern: Infrastructure-Level security for autonomous AI agents,” Zenodo (CERN European Organization for Nuclear Research). Feb. 11, 2026. doi: 10.5281/zenodo.18614503.

[33]. A. K. Kanagala, “Zero-Trust security architecture for AI agent orchestration in cloud environments: A reference design and implementation framework,” Zenodo (CERN European Organization for Nuclear Research), Jul. 2025, doi: 10.5281/zenodo.20569496.

[34]. E. Meyman, “Execution-Time authorization for AI agents: A formal framework for deterministic governance boundaries,” Zenodo (CERN European Organization for Nuclear Research). Feb. 24, 2026. doi: 10.5281/zenodo.18764561.

[35]. R. Haider, W. A. Megha, J. T. Juba, A. Alamgir, and L. Ahmad, “The conversational revolution in health promotion: Investigating chatbot impact on healthcare marketing, patient engagement, and service reach,” International Journal of Science and Research Archive, vol. 15, no. 3, pp. 1585–1592, Jun. 2025, doi: 10.30574/ijsra.2025.15.3.1937.

[36]. F.-A. Chitan, “Policy constraint layer (PCL): Deterministic context-bound authorization for agentic AI systems,” 2025. doi: 10.5281/zenodo.19222977.

[37]. R. Haider, F. A. I. Bari, Osru, N. Afia, and M. A. khan Mugdho, “Leveraging internet of things data for real-time marketing: Opportunities, challenges, and strategic implications,” International Journal of Science and Research Archive, vol. 15, no. 3, pp. 1657–1663, Jun. 2025, doi: 10.30574/ijsra.2025.15.3.1936.

[38]. A. Joshi, T. Finin, K. P. Joshi, and L. Kagal, “Deontic policies for runtime governance of agentic AI systems,” arXiv (Cornell University). Jun. 17, 2026. doi: 10.48550/arxiv.2606.19464.

[39]. U. U. Uchibeke and Ap. T. Inc., “Open Agent Passport (OAP) Specification: Authorization Specification for AI Agent Guardrails,” Open MIND, 2026.

[40]. R. Haider, M. Bari, Md. F. I. Shaif, M. Rahman, Md. N. H. Ohi, and K. M. M. Rahman, “Quantifying the impact: Leveraging AI-Powered sentiment analysis for strategic digital marketing and enhanced brand reputation management,” International Journal of Science and Research Archive, vol. 15, no. 2, pp. 1103–1121, May 2025, doi: 10.30574/ijsra.2025.15.2.1524.

[41]. A. K. Sharma, “AEGIS: Evidence-Driven runtime governance for autonomous AI agents,” Zenodo (CERN European Organization for Nuclear Research), May 2026, doi: 10.5281/zenodo.19998805.

[42]. H. An et al., “IPIGuard: A novel tool dependency graph-based defense against indirect prompt injection in LLM agents,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Stroudsburg, PA, USA: Association for Computational Linguistics, 2025, pp. 1023–1039. doi: 10.18653/v1/2025.emnlp-main.53.

[43]. Q. Yu, X. Cheng, and C. Liu, “Defense Against Indirect Prompt Injection via Tool Result Parsing,” ArXiv.org, 2026, [Online]. Available: https://arxiv.org/pdf/2601.04795

[44]. A. Guo, “Decision-Space counterfactual auditing for prompt injection defense in tool-using LLM agents: Code and evaluation artifacts,” Figshare, Jun. 2026, doi: 10.6084/m9.figshare.32657856.v1.

[45]. J. Wanger, “Open agent trust stack (OATS): A system specification for zero-trust AI agent execution,” Zenodo (CERN European Organization for Nuclear Research). Apr. 17, 2026. doi: 10.5281/zenodo.19636534.

[46]. R. Haider, M. Bari, Md. F. I. Shaif, and M. Rahman, “Engineering hyper-personalization: Software challenges and brand performance in AI-driven digital marketing management: An empirical study,” International Journal of Science and Research Archive, vol. 15, no. 2, pp. 1122–1141, May 2025, doi: 10.30574/ijsra.2025.15.2.1525.

[47]. U. Uchibeke, “Before the tool call: Deterministic pre-action authorization for autonomous AI agents,” arXiv (Cornell University). Mar. 21, 2026. doi: 10.48550/arxiv.2603.20953.

[48]. R. Haider, M. Bari, Osru, N. Afia, and T. Al Karim, “Illuminating the black box: Explainable AI for enhanced customer behavior prediction and trust,” International Journal of Science and Research Archive, vol. 15, no. 3, pp. 247–268, Jun. 2025, doi: 10.30574/ijsra.2025.15.3.1674.

[49]. P. P. Motgi, “SECURING AUTONOMOUS AI AGENTS: DISTRIBUTED, SANDBOXED EXECUTION ENVIRONMENTS VIA WEBASSEMBLY AND KUBERNETES,” Zenodo (CERN European Organization for Nuclear Research), Jun. 2026, doi: 10.5281/zenodo.20535686.

[50]. S. Maiti, “Caging the agents: A zero trust security architecture for autonomous AI in healthcare,” arXiv (Cornell University). Mar. 18, 2026. doi: 10.48550/arxiv.2603.17419.

[51]. R. Haider and J. Sabatina, “Harnessing the power of micro-influencers: A comprehensive analysis of their effectiveness in promoting climate adaptation solutions,” International Journal of Science and Research Archive, vol. 15, no. 2, pp. 595– 610, May 2025, doi: 10.30574/ijsra.2025.15.2.1448.

[52]. A. Aravind, “AgentWall: A runtime safety layer for local AI agents,” arXiv (Cornell University). Mar. 24, 2026. doi: 10.48550/arxiv.2605.16265.

[53]. R. Haider, “Navigating the digital political landscape: How social media marketing shapes voter perceptions and political brand equity in the 21st century,” International Journal of Science and Research Archive, vol. 15, no. 1, pp. 1736–1744, Apr. 2025, doi: 10.30574/ijsra.2025.15.1.1217.

[54]. S. Xu and Y. Qian, “Zero trust architecture for edge AI security: A framework for distributed intelligence protection,” IEEE Communications Magazine, pp. 1–10, 2026, doi: 10.1109/mcom.001.2500749.

[55]. K. Zhu, X. Yang, J. Wang, W. Guo, and W. Y. Wang, “MELON: Provable defense against indirect prompt injection attacks in AI agents,” arXiv (Cornell University). Feb. 07, 2025. doi: 10.48550/arxiv.2502.05174.

[56]. Y. Zhang, X. Deng, J. Wu, Y. Xiao, K. Xu, and Q. Li, “AgentWard: A lifecycle security architecture for autonomous AI agents,” arXiv (Cornell University). Apr. 27, 2026. doi: 10.48550/arxiv.2604.24657.

[57]. M. El Helou, B. Ryder, C. Troiani, J. Diaconu, H. Muyal, and M. Yannuzzi, “Hybrid inspection and task-based access control in zero-trust agentic AI,” arXiv (Cornell University). May 04, 2026. doi: 10.48550/arxiv.2605.02682.

[58]. J. Berroa, “Agent authority infrastructure: A framework for runtime authority, approval, and evidence in AI agents,” Zenodo (CERN European Organization for Nuclear Research), May 2026, doi: 10.5281/zenodo.20237200.

[59]. Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” in Findings of the Association for Computational Linguistics ACL 2024, Stroudsburg, PA, USA: Association for Computational Linguistics, 2024, pp. 10471–10506. doi: 10.18653/v1/2024.findings-acl.624.

[60]. R. Haider, “The algorithmic memory of brands: Developing a longitudinal theory of how large language models learn, retain, distort and correct brand knowledge proposal field details,” Jul. 2026, doi: 10.13140/rg.2.2.26017.36966.

[61]. L. Zhao, A. Bhaskar, and E. Dobriban, “LivePI: More realistic benchmarking of agents against indirect prompt injection,” arXiv (Cornell University). May 18, 2026. doi: 10.48550/arxiv.2605.17986.