Zero Trust technical win

Zero Trust for Agentic AI

The customer wants to move fast with AI agents. The technical win is showing how Cloudflare connects, protects, and governs access from humans and agents to models, memory, and tools, without turning static secrets and API keys into the trust model.

A customer story, an architecture, and a proof plan.

About me

Identity, engineering, network, security and the path in between

20+ years connecting identity to business outcomes
ID

Identity and access

Auth0/Okta, customer and workforce identity, authorization design, modernization programs, and customer-facing technical leadership.

ENG

Engineering and delivery

Turning architecture into working proofs through API and integration design, automation, secure delivery pipelines, and pragmatic implementation plans.

ZT

Network security and emerging identity

Zero Trust journeys, secure paths, verifiable credentials, mobile driver’s license patterns, and standards-based architectures.

Off the clock

My most demanding production environment

GlampingDivingFamily

Husband and father of two, campfire cook, and occasional family support desk. My toughest stakeholders still do not accept maintenance windows.

Account partnership

Before we continue...

The best technical outcome starts with one account team, one customer story, and explicit qualification.

01

One account team

Share one account plan and one definition of the customer problem.

Agree who leads business discovery, technical discovery, and the close.

Pre-wire meetings, surface disagreement early, and debrief immediately.

Protect trust: never surprise each other in front of the customer.

Business pain

What is broken, who feels it, and what happens if nothing changes?

Measurable impact

Which security, cost, speed, or risk metric defines value?

Stakeholders

Economic buyer, champion, security, AI platform, application, legal, and procurement.

Decision path

Decision criteria, approvals, paper process, alternatives, and status quo.

Timeline

Compelling event, production date, dependencies, and available customer time.

Exit criteria

What must the proof demonstrate, who signs it, and what would stop the cycle?

Joint checkpoint: should we invest in a technical cycle? If yes, what must be true when it ends?
Customer discovery

Here is what we heard from the customer

Who is the agent acting as?

The human disappears once the runtime holds its own credential.

What can it reach?

Models, memory, internal APIs, and tools grow through separate paths.

What did it actually do?

Evidence is fragmented across model, application, and tool layers.

The customer sees two connected problems: risky AI behavior and uncontrolled access

AI + access risk

Manipulated intent

Prompts and external content can redirect the agent.

Sensitive context leakage

Private data can leave through prompts, memory, or responses.

Autonomous actions

The agent can change systems before a human approves the action.

Uncontrolled consumption

One agent can create unexpected model usage, cost, and availability problems.

Provider uncertainty

Not every model provider handles enterprise data the same way.

Network-wide access

The VPN gives the agent a network when it only needs one application.

Exposed private services

Internal APIs become public because the agent needs to reach them.

Shared machine secrets

API keys are copied across runtimes and are difficult to rotate or revoke.

Fragmented policy

Humans, applications, and agents follow different access rules in every environment.

No precise containment

If an agent is compromised, we cannot disable only its permitted path.

Market context

Customers want model choice and evidence of control

01

Private AI in practice

Palantir helped define an enterprise AI model that operates close to governed data and business workflows—embedding engineers in operations while keeping data within the customer’s control boundary.

02

Open models have strategic weight

NVIDIA, Microsoft, Meta, and Hugging Face are investing in open-model ecosystems—making choice, portability, sovereignty, and control an enterprise strategy.

03

Mixed estates are the norm

Open and closed models can run side by side: private placement for sensitive work, frontier capability where sharing context is justified.

Brazil signal 01

National investment

The national AI plan commits R$23 billion, including Portuguese-language capability and advanced national compute infrastructure.

Brazil signal 02

Sovereign operations

Serpro promotes sovereign-cloud and Portuguese-language AI initiatives for government workloads.

Brazil signal 03

Policy scrutiny

Brazil’s data law and pending AI framework increase scrutiny of data transfers, processing, accountability, and procurement.

The expanding surface

Brain, memory, and hands can sprawl anywhere

Brain · models

A new model is one endpoint away

Any team can add a hosted provider or local model with a few lines of code.

Models may run on-premises, at the edge, in a cloud, or behind a SaaS service.

Direct endpoints create separate cost, data, availability, and policy paths.

Memory · knowledge

A new data surface is one API away

Anyone can publish retrieval, vector, graph, file, or memory APIs.

Copies, embeddings, and retrieved context move across environments.

Every store creates a new authentication, authorization, and data boundary.

Hands · tools

A new action is one MCP connection away

Teams can connect a Model Context Protocol server or SaaS tool in minutes.

Tools carry credentials and produce real side effects.

Unmanaged integrations multiply faster than security review and ownership.

One agent becomes a distributed attack surface. Each piece can run somewhere different, so brain, memory, and hands require different control strategies.
The operating model

Build, connect, protect, and govern the agentic AI estate

Build

Choose where applications, models, memory, and tools should run for each workload.

Connect

Establish the human or machine identity and the allowed path to the service.

Protect

Apply application, API, and AI-specific controls at every exposed boundary.

Govern

Observe and limit model use, tool access, cost, data movement, and exceptions.

The control plane follows the path. It does not force every brain, memory store, or tool into the same location.

Cloudflare stack

Each control solves a different part of the problem

Build

Workers + Workers AI

Deploy AI applications and APIs, and place selected inference on Cloudflare when the workload fits.

Connect

Access + Tunnel

Apply identity-first reachability and connect private origins through outbound-only tunnels without opening inbound paths.

Protect apps + APIs

WAF + API Shield + AI Security for Apps

Block web threats; discover APIs; validate schemas, JWTs, or mTLS; and add LLM-specific signals for prompt injection, personal data, and unsafe topics.

Govern models

AI Gateway

Observe routed outbound model calls and control tokens, cost, caching, rate limits, retries, and model fallback.

Govern tools

MCP server portals + Access

Centralize servers behind one endpoint, authenticate non-browser clients with OAuth, curate tools, log requests, and optionally route through Gateway for DLP.

Different insertion points, one platform: inbound application and API protection is not outbound model governance, and neither replaces tool authorization.
Future state architecture

One architecture, three governed paths

Auth0 role claimAccess RBAC routes
deck OR admin
Deckhttp://deck.trustfabriclabs.com/
admin only
Memoryhttps://memory.trustfabriclabs.com/

Users + Auth0

Browser traffic arrives with OpenID Connect identity and role claims.

deck · admin

Application or agent runtime

Calls approved model endpoints through a governed route.

MCP client

A non-browser client requests scoped tool access.

Cloudflare connectivity cloud

Access

Authenticate and enforce the hostname role policy.

WAF + API Shield + AI Security

Validate web, API, and LLM requests.

Pages or Tunnel

Serve at the edge or reach a private origin.

AI Gateway

Logs, tokens, cost, caching, limits, retries, routing, and fallback.

Access

Managed OAuth for the MCP client.

MCP server portal

Curated tools, credential routing, and logs.

Gateway, optional

HTTP logs, DLP, and egress control.

Protected application surfaces

Pages presentation plus private memory services.

cf-fse… · memory… · memory-api…

Approved model services

Workers AI, frontier providers, approved gateways, and private local models.

Upstream tools

OAuth, bearer-token, or unauthenticated MCP servers.

Application path
Users + Auth0Browser request arrives with a deck or admin role claim.
AccessAuthenticate and enforce the hostname RBAC policy.
WAF + API Shield + AI SecurityValidate web, API, and LLM requests.
Pages or TunnelServe the deck at the edge or reach private memory services.
Protected application surfacesDeck presentation and private memory services.
Model path
Application or agent runtimeCall an approved model through a governed route.
AI GatewayLogs, tokens, cost, caching, limits, retries, routing, and fallback.
Approved model servicesWorkers AI, frontier providers, gateways, or private local models.
Tool path
MCP clientRequest scoped tool access without relying on a copied key.
Access + MCP server portalManaged OAuth, curated tools, credential routing, and logs.
Gateway, optionalHTTP logging, DLP, and egress control.
Upstream toolsOAuth, bearer-token, or unauthenticated MCP servers.
Technical win plan

What we prove together in two weeks

Week01Reach the estate
01

Prove identity-first access

Role decides which surface is reachable. Test the allowed role, the wrong role, and the missing identity.

02

Prove the origin remains private

Only configured services are reachable through the outbound-only Tunnel. No direct inbound origin path.

Week02Govern the paths
03

Prove model governance

Route model traffic through AI Gateway and verify logs, limits, cost visibility, and provider behavior.

04

Prove delegated tool access

Authenticate one MCP client through Access, scope its tools, confirm request evidence, and retire the copied key.

Joint exit criteria

Security and AI platform owners witness the tests, approve the evidence, and sign the result together.

Technical win → decision
What the customer gains

Cloudflare governs the paths around agentic AI

Application + API01

Bring AI applications to production without exposing private services

Identity-first access and private connectivity reduce origin exposure.

Private accessAccess and Tunnel keep origins private.
API assuranceDiscovery, schema, JWT, mTLS, and sequence controls.
Prompt injectionInjection and jailbreak signals drive WAF policy.
Data policyPII and unsafe or custom topic signals.
Model path02

Preserve model choice while controlling cost and reliability

A governed model path provides visibility, resilience, and spend control across providers.

AnalyticsRequests, tokens, and cost.
LoggingRequests, errors, and behavior.
CachingFaster responses and lower provider cost.
ResilienceLimits, retries, fallback, spend controls, and routing.
Tool path03

Expand agent capabilities without multiplying credential risk

Scoped identity and curated tools replace shared keys; applications still authorize each action.

Managed OAuthOAuth clients and service tokens.
Curated toolsOne endpoint, selected tools, and aliases.
EvidenceTool request logs and optional Logpush.
Gateway DLPInspect and block sensitive tool requests and responses.
Business outcomeAdopt agentic AI faster—with model choice, a smaller attack surface, and evidence security teams can approve.
1 / 11