PoC-stage HOLD / ALLOW / DENY gate.
AGENT ZERO TRUST / PUBLIC EXPLANATION
Zero Trust for AI agents: decide, record and revoke each request
Do not continuously trust an agent just because an earlier action was approved. The Japanese source proposes a fresh decision, traceable record and potential revocation for each request.
Do not rely on continuing trust
An earlier authorization can outlive the conditions that justified it. A Zero Trust design reassesses each new request as circumstances change.
- Design aim: support stopping a request when context or authority changes.
Decision, record and revocation
The source describes HOLD / ALLOW / DENY, retaining a record and supporting revocation. The ITS API is a PoC-stage interface with resolve, status, latest, history and revoke entry points, not proof of live enterprise identity integration.
- Design aim: least privilege with a traceable revocation path.
Combine with a structural gate
Topological Gatekeeper checks request structure, route and external side effects. The question includes which authority can change which external state, not only whether a statement sounds reasonable.
- Design aim: make permission and external effects inspectable.
Related sources and materials
Japanese ITS design context.
Version, evidence and bounded claims.
Structural and external-effect gate.
Companion explanation of pre-execution stopping.
doc_id: C3-WEB-ANSWERS-ZERO-TRUST-EN-0.1 / version: 0.1.0 / status: REVIEW_REQUIRED / translated: 2026-10-13 / source_doc_id: C3-WEB-ANSWERS-ZERO-TRUST-0.1 / source_last_updated: 2026-06-05