Zero Trust Security Design

No implicit trust. No trusted perimeter. Every interaction verified.

The Enterprise Kit implements 17 Zero Trust controls woven into every architectural plane — from identity and network through execution, observability, and MCP fleet governance. AI agents break the traditional perimeter model because they make autonomous decisions, invoke external tools, and generate content consumed by other agents. Zero Trust for Agentic AI demands continuous verification at every boundary.

Three Zero Trust Principles for AI Agents

Verify Explicitly

Every agent identity is authenticated via Entra. Every tool call is authorized. Every model invocation is RBAC-gated. No anonymous agents reach production.

Least Privilege

Per-agent-class tool allowlists. Approval tiers for write operations. User-scoped memory isolation. Data boundary geo-fencing. No agent gets more access than its manifest declares.

Assume Breach

Runtime interceptor with kill switch. Hash-chained decision ledger. Continuous anomaly detection. 14 automated remediation workflows. Every action is auditable, every anomaly triggers response.

Security by Architectural Layer

Each of the 7 architectural planes has dedicated Zero Trust controls. Security is not a bolt-on — it is embedded at every boundary.

Control Plane — Agent 365 Security

Control	What It Does	Business Value
ZT-01: Identity	Entra Agent Identity blueprint with 3 User-Assigned Managed Identities (agent, deploy, monitor). Per-agent RBAC role assignments. No shared credentials.	Every agent has a verified, auditable identity — enables governance at scale across Foundry, Copilot Studio, and third-party agents
ZT-09: Azure Policy	Governance initiative with 12+ policy definitions. Tag enforcement. Resource compliance scanning. Deny-by-default for non-compliant configurations.	Prevents configuration drift — non-compliant agents cannot deploy to production

Execution Plane — Runtime Security

Control	What It Does	Business Value
ZT-02: API Gateway	APIM JWT validation with per-agent claims. Rate limiting (60 RPM/tool, 200 RPM/agent). IP filtering (RFC 1918). Header sanitization. Semantic caching.	Prevents unauthorized access, stops abuse at the edge, reduces model costs via caching
ZT-03: AI Gateway	Content Safety filtering (text + image). Prompt injection detection. DLP integration via Purview. AI Search private endpoint. Input/output classification.	Stops harmful content and data exfiltration before they reach models or leave the system
ZT-05: Runtime Interceptor	Per-step Zero Trust middleware. Kill switch with policy-based triggers. Token budget enforcement. Anomaly-based halt. Step-up approval for sensitive operations. All decisions logged to Decision Ledger.	The “assume breach” control — halts rogue agents in real-time before damage spreads
ZT-06: Model Gateway	Model deployment RBAC. Inference rate limiting. Model version pinning (no silent upgrades). Endpoint protection via VNet.	Ensures only approved models serve production traffic — prevents supply chain attacks via model substitution
ZT-07: Agent Communication	A2A AgenticIdentity authentication. MCP gateway authorization. Identity propagation across agent chains. Egress control (outbound allowlists).	Prevents impersonation in multi-agent orchestration — every delegation carries verified identity

Governance & Observability Plane — Compliance Security

Control	What It Does	Business Value
ZT-08: Telemetry	OTel pipeline with field-level PII masking. App Insights private endpoint. Structured traces with correlation IDs. No PII in logs or telemetry.	Full observability without data protection violations — GDPR/CCPA-safe telemetry
ZT-13: Evaluation Security	Eval dataset protection (RBAC-gated access). Result integrity validation (hash verification). Ground truth isolation from production data.	Prevents test data contamination — evaluation results are trustworthy and tamper-proof
ZT-14: Continuous Monitoring	Anomaly detection with configurable thresholds. Alert-triggered remediation (14 workflows). Cost spike detection. Latency regression alerts.	Automated incident response — anomalies trigger containment without human intervention

Trust & Certification Plane — Data Protection

Control	What It Does	Business Value
ZT-04: Secrets & Keys	Key Vault with CMK encryption. Certificate rotation (auto). Private endpoint. Soft-delete + purge protection. RSA signing for ledger entries.	Cryptographic integrity — audit trails are signed and cannot be backdated or falsified
ZT-10: Data Boundary	Cosmos DB geo-fencing with data residency enforcement. Cross-region replication controls. Purview sensitivity label integration.	Data sovereignty compliance — regulated data never leaves approved geographic regions
ZT-11: Memory Governance	Separate operational vs. compliance memory retention. User-scoped partition keys. Memory purge on session end. Cross-agent isolation.	Prevents memory poisoning — one agent's context cannot leak to or influence another

Shared Infrastructure — Network Security

All PaaS services are deployed with private endpoints inside a VNet with 5 subnets (agent, model, data, MCP, management) and NSG rules. 6 Private DNS Zones resolve internal FQDNs. No public internet exposure. TLS 1.2+ enforced on all connections.

MCP Fleet Governance — Tool Supply Chain Security

Control	What It Does	Business Value
ZT-12: Toolbox	Per-agent-class tool allowlists. Version governance (only promoted versions in production). Approval tiers: read=auto, write=require, admin=require+escalation.	Prevents over-privileged tool access — agents can only use tools their manifest explicitly declares
ZT-15: MCP Security	5 MCP auth methods (Key, Entra Agent Identity, MI, OAuth, Unauthenticated). TLS 1.2+ transport. VNet-only ingress. Per-agent session limits. Tool-level authorization. Supply chain validation (image signing, dependency scanning).	Enterprise-grade MCP security — the most comprehensive MCP server security model available

Trust Profiles

Three predefined trust profiles control module enforcement levels across environments. Profiles are defined in zero-trust/zt-profiles.yaml.

Profile	Enforcement	Use Case
`zt-strict`	All 15 modules enforced, no exceptions. Kill switch active. All decisions ledgered.	Production / regulated industries (banking, healthcare, government)
`zt-standard`	Core modules enforced (ZT-01 through ZT-07). Optional modules in audit mode (log but don't block).	Staging / pre-production validation
`zt-permissive`	Identity + audit only. All other modules advisory (emit warnings, don't block).	Development / prototyping / proof of concept

Policy Enforcement Lifecycle

Pre-execution — Identity verification (ZT-01), RBAC check (ZT-02), toolbox allowlist validation (ZT-12), data boundary check (ZT-10)
During execution — Content safety filtering (ZT-03), runtime interceptor gate (ZT-05), PII masking (ZT-08), memory isolation (ZT-11)
Post-execution — Decision ledger recording (ZT-04/07), evaluation scoring (ZT-13), anomaly detection (ZT-14)
Continuous — Scorecard compilation, certification pipeline gates, compliance reporting, fleet-wide policy reconciliation

Reference Architecture Diagram

┌─────────────────────────────────────────────────────────────────┐
│                     User / Calling System                       │
│              [Entra ID Auth → ZT-01 Identity Check]             │
└──────────────────────────┬──────────────────────────────────────┘
                           │ mTLS + OAuth 2.0
┌──────────────────────────▼──────────────────────────────────────┐
│              API Management — AI Gateway (ZT-02/03)             │
│  [JWT + Per-Agent RBAC] [llm-content-safety] [llm-token-limit] │
│  [llm-semantic-cache] [llm-emit-token-metric] [Rate Limiting]  │
│  [ZT-09 Threat Detection]                                       │
└──────────────────────────┬──────────────────────────────────────┘
                           │ Private Endpoint
┌──────────────────────────▼──────────────────────────────────────┐
│          Runtime Interceptor — ZT-05 Per-Step Enforcement       │
│  [Kill Switch] [Identity Verify] [Policy Check] [Content Scan] │
│  [Scope Narrowing] [Runaway Protection] [Step-Up Approval]     │
│  ┌──────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
│  │ Foundry Agent │  │  MCP Toolbox │  │   Foundry Guardrails  │  │
│  │  [ZT-02 RBAC] │  │[ZT-12 Auth]  │  │ [ZT-03 Content Safe]  │  │
│  └──────┬───────┘  └──────┬───────┘  └───────────┬───────────┘  │
│         │                 │                       │              │
│  ┌──────▼─────────────────▼───────────────────────▼──────────┐  │
│  │       Enterprise Adapters (MCP Protocol — ZT-15)          │  │
│  │  ServiceNow │ SAP │ Salesforce │ Workday │ MSGraph        │  │
│  │  [TLS] [CORS] [Retry+Backoff] [PII Masking] [OAuth]      │  │
│  └───────────────────────────────────────────────────────────┘  │
└──────────────────────────┬──────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────────┐
│              Governance & Observability Plane                    │
│  ┌──────────────────┐  ┌──────────────────┐  ┌──────────────┐  │
│  │   Policy Engine   │  │  Continuous Eval  │  │  App Insights │  │
│  │ [ZT-10 Boundary]  │  │  [ZT-13 Eval]     │  │  [ZT-08 Tele] │  │
│  └──────────────────┘  └──────────────────┘  └──────────────┘  │
│  [ZT-09 Azure Policy] [ZT-14 Continuous Monitoring + Alerts]   │
└──────────────────────────┬──────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────────┐
│               Trust & Certification Plane                       │
│  ┌──────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
│  │Decision Ledger│  │  Scorecard   │  │ Certification Pipeline│  │
│  │[ZT-04 Crypto] │  │  Compiler    │  │   [Bronze/Silver/Gold]│  │
│  └──────────────┘  └──────────────┘  └───────────────────────┘  │
│                                                                  │
│  [ZT-10 Data Boundary] [ZT-11 Memory Gov] [ZT-07 Agent Comms]  │
└──────────────────────────┬──────────────────────────────────────┘
                           │
┌──────────────────────────▼──────────────────────────────────────┐
│               MCP Fleet Governance Plane (WS-9)                 │
│  ┌────────────────┐  ┌──────────────┐  ┌────────────────────┐  │
│  │Toolbox Lifecycle│  │  Tool Catalog │  │  MCP Auth Provider │  │
│  │ [ZT-12 Govern]  │  │[API Center]   │  │  [5 Auth Methods]  │  │
│  └────────────────┘  └──────────────┘  └────────────────────┘  │
│  [ZT-15 MCP Security] [Transport TLS] [Supply Chain Validation]│
└──────────────────────────────────────────────────────────────────┘

Configuration

Zero Trust modules are configured in zero-trust/*.yaml files. Each module YAML defines the enforcement level (enforce, audit, or disabled), applicable agent types, and Azure resource bindings. See the full design document at docs/ZERO-TRUST-DESIGN.md.

Module Files

File	Control
`zt-01-identity.yaml`	Identity Foundation — Entra ID + Managed Identity hierarchy
`zt-02-api-gateway.yaml`	API Gateway — APIM JWT, rate limiting, IP filtering
`zt-03-ai-gateway.yaml`	AI Gateway — Content Safety, prompt injection, DLP
`zt-04-registration.yaml`	Secrets & Keys — Key Vault, CMK, certificate rotation
`zt-05-runtime-interceptor.yaml`	Runtime Interceptor — kill switch, token budget, step-up approval
`zt-06-model-gateway.yaml`	Model Gateway — deployment RBAC, version pinning
`zt-07-agent-communication.yaml`	Agent Communication — A2A auth, identity propagation
`zt-08-telemetry.yaml`	Telemetry — OTel pipeline, PII masking
`zt-09-azure-policy.yaml`	Azure Policy — governance initiative, tag enforcement
`zt-10-data-boundary.yaml`	Data Boundary — geo-fencing, residency
`zt-11-memory-governance.yaml`	Memory Governance — retention, user isolation
`zt-12-toolbox.yaml`	Toolbox — allowlists, version governance, approval tiers
`zt-13-evaluation.yaml`	Evaluation Security — dataset protection, result integrity
`zt-14-continuous-monitoring.yaml`	Continuous Monitoring — anomaly detection, remediation
`zt-15-mcp-security.yaml`	MCP Security — server auth, transport, tool authz, supply chain
`zt-16-compliance-automation.yaml`	Compliance Automation — continuous evidence collection, framework mapping
`zt-17-data-residency.yaml`	Data Residency — sovereign data controls, geo-fencing, cross-border enforcement