Zero Trust for Agentic AI
The customer wants to move fast with AI agents. The technical win is showing how Cloudflare connects, protects, and governs access from humans and agents to models, memory, and tools, without turning static secrets and API keys into the trust model.
A customer story, an architecture, and a proof plan.
Identity, engineering, network, security and the path in between
Identity and access
Auth0/Okta, customer and workforce identity, authorization design, modernization programs, and customer-facing technical leadership.
Engineering and delivery
Turning architecture into working proofs through API and integration design, automation, secure delivery pipelines, and pragmatic implementation plans.
Network security and emerging identity
Zero Trust journeys, secure paths, verifiable credentials, mobile driver’s license patterns, and standards-based architectures.
My most demanding production environment
Husband and father of two, campfire cook, and occasional family support desk. My toughest stakeholders still do not accept maintenance windows.
Before we continue...
The best technical outcome starts with one account team, one customer story, and explicit qualification.
One account team
Share one account plan and one definition of the customer problem.
Agree who leads business discovery, technical discovery, and the close.
Pre-wire meetings, surface disagreement early, and debrief immediately.
Protect trust: never surprise each other in front of the customer.
Business pain
What is broken, who feels it, and what happens if nothing changes?
Measurable impact
Which security, cost, speed, or risk metric defines value?
Stakeholders
Economic buyer, champion, security, AI platform, application, legal, and procurement.
Decision path
Decision criteria, approvals, paper process, alternatives, and status quo.
Timeline
Compelling event, production date, dependencies, and available customer time.
Exit criteria
What must the proof demonstrate, who signs it, and what would stop the cycle?
Here is what we heard from the customer
Who is the agent acting as?
The human disappears once the runtime holds its own credential.
What can it reach?
Models, memory, internal APIs, and tools grow through separate paths.
What did it actually do?
Evidence is fragmented across model, application, and tool layers.
The customer sees two connected problems: risky AI behavior and uncontrolled access
AI + access riskManipulated intent
Prompts and external content can redirect the agent.
Sensitive context leakage
Private data can leave through prompts, memory, or responses.
Autonomous actions
The agent can change systems before a human approves the action.
Uncontrolled consumption
One agent can create unexpected model usage, cost, and availability problems.
Provider uncertainty
Not every model provider handles enterprise data the same way.
Network-wide access
The VPN gives the agent a network when it only needs one application.
Exposed private services
Internal APIs become public because the agent needs to reach them.
Shared machine secrets
API keys are copied across runtimes and are difficult to rotate or revoke.
Fragmented policy
Humans, applications, and agents follow different access rules in every environment.
No precise containment
If an agent is compromised, we cannot disable only its permitted path.
Customers want model choice and evidence of control
Private AI in practice
Palantir helped define an enterprise AI model that operates close to governed data and business workflows—embedding engineers in operations while keeping data within the customer’s control boundary.
Open models have strategic weight
NVIDIA, Microsoft, Meta, and Hugging Face are investing in open-model ecosystems—making choice, portability, sovereignty, and control an enterprise strategy.
Mixed estates are the norm
Open and closed models can run side by side: private placement for sensitive work, frontier capability where sharing context is justified.
National investment
The national AI plan commits R$23 billion, including Portuguese-language capability and advanced national compute infrastructure.
Sovereign operations
Serpro promotes sovereign-cloud and Portuguese-language AI initiatives for government workloads.
Policy scrutiny
Brazil’s data law and pending AI framework increase scrutiny of data transfers, processing, accountability, and procurement.
Brain, memory, and hands can sprawl anywhere
A new model is one endpoint away
Any team can add a hosted provider or local model with a few lines of code.
Models may run on-premises, at the edge, in a cloud, or behind a SaaS service.
Direct endpoints create separate cost, data, availability, and policy paths.
A new data surface is one API away
Anyone can publish retrieval, vector, graph, file, or memory APIs.
Copies, embeddings, and retrieved context move across environments.
Every store creates a new authentication, authorization, and data boundary.
A new action is one MCP connection away
Teams can connect a Model Context Protocol server or SaaS tool in minutes.
Tools carry credentials and produce real side effects.
Unmanaged integrations multiply faster than security review and ownership.
Build, connect, protect, and govern the agentic AI estate
Build
Choose where applications, models, memory, and tools should run for each workload.
Connect
Establish the human or machine identity and the allowed path to the service.
Protect
Apply application, API, and AI-specific controls at every exposed boundary.
Govern
Observe and limit model use, tool access, cost, data movement, and exceptions.
The control plane follows the path. It does not force every brain, memory store, or tool into the same location.
Each control solves a different part of the problem
Workers + Workers AI
Deploy AI applications and APIs, and place selected inference on Cloudflare when the workload fits.
Access + Tunnel
Apply identity-first reachability and connect private origins through outbound-only tunnels without opening inbound paths.
WAF + API Shield + AI Security for Apps
Block web threats; discover APIs; validate schemas, JWTs, or mTLS; and add LLM-specific signals for prompt injection, personal data, and unsafe topics.
AI Gateway
Observe routed outbound model calls and control tokens, cost, caching, rate limits, retries, and model fallback.
MCP server portals + Access
Centralize servers behind one endpoint, authenticate non-browser clients with OAuth, curate tools, log requests, and optionally route through Gateway for DLP.
One architecture, three governed paths
Users + Auth0
Browser traffic arrives with OpenID Connect identity and role claims.
Application or agent runtime
Calls approved model endpoints through a governed route.
MCP client
A non-browser client requests scoped tool access.
Access
Authenticate and enforce the hostname role policy.
WAF + API Shield + AI Security
Validate web, API, and LLM requests.
Pages or Tunnel
Serve at the edge or reach a private origin.
AI Gateway
Logs, tokens, cost, caching, limits, retries, routing, and fallback.
Access
Managed OAuth for the MCP client.
MCP server portal
Curated tools, credential routing, and logs.
Gateway, optional
HTTP logs, DLP, and egress control.
Protected application surfaces
Pages presentation plus private memory services.
Approved model services
Workers AI, frontier providers, approved gateways, and private local models.
Upstream tools
OAuth, bearer-token, or unauthenticated MCP servers.
What we prove together in two weeks
Prove identity-first access
Role decides which surface is reachable. Test the allowed role, the wrong role, and the missing identity.
Prove the origin remains private
Only configured services are reachable through the outbound-only Tunnel. No direct inbound origin path.
Prove model governance
Route model traffic through AI Gateway and verify logs, limits, cost visibility, and provider behavior.
Prove delegated tool access
Authenticate one MCP client through Access, scope its tools, confirm request evidence, and retire the copied key.
Security and AI platform owners witness the tests, approve the evidence, and sign the result together.
Technical win → decisionCloudflare governs the paths around agentic AI
Bring AI applications to production without exposing private services
Identity-first access and private connectivity reduce origin exposure.
Preserve model choice while controlling cost and reliability
A governed model path provides visibility, resilience, and spend control across providers.
Expand agent capabilities without multiplying credential risk
Scoped identity and curated tools replace shared keys; applications still authorize each action.