Zero trust principles — verify explicitly, use least privilege, assume breach — were designed for human users accessing applications. AI introduces new principals (agents, models, automated workflows) that don't fit into traditional IAM models.
Autonomous AI agents make hundreds of decisions and tool calls per session. Each one should be treated as a separate access request — but most zero trust platforms have no concept of an AI agent principal.
AI models are often given broad access "for flexibility." Kovral enforces least-privilege at the model level — each model gets the minimum permissions required for its specific use case.
Attackers can use a compromised AI interaction to pivot to other systems via tool calls or prompt injection. Kovral's zero trust enforcement prevents lateral movement by restricting what each model and agent can access.
Traditional access logs don't capture AI decision chains. Kovral creates an immutable audit trail of every AI access decision — who asked what, what the model decided, what it accessed.
Kovral implements zero trust for AI across four enforcement layers.
Every AI request is associated with a verified identity — user, service account, or agent. Kovral integrates with your IdP (Okta, Azure AD, Google) to bind AI interactions to verified identities.
Policy rules restrict which identities can call which models with which capabilities. Example: "Customer service agents may call GPT-4o-mini but not GPT-4o; they may not use code interpreter or file access tools."
Risk context (device posture, location, time of day, behavioural anomalies) adjusts access decisions in real time. A user accessing AI from an unusual location gets step-up authentication or reduced permissions.
Sessions are not trusted after initial authentication. Kovral monitors every interaction within a session and can terminate access mid-session if behaviour deviates from the authorised pattern.
