Science ministry issues zero-trust guide for agentic AI deployments

South Korea's science ministry said Thursday it published a guidebook for applying zero-trust security to agentic AI, a framework built for corporate environments where software agents now act on their own rather than simply analyzing or generating information.

The Ministry of Science and ICT prepared the guide with the Korea Internet & Security Agency, or KISA, after analyzing major domestic and foreign AI security and zero-trust guides and collecting feedback from both the companies that would use it and the vendors that would supply it. The guidebook, "Agentic AI Zero Trust Guide," is based on the four-stage maturity model set out in the Zero Trust Guideline 2.0 published in December 2024, extended to cover agentic AI environments with concrete application criteria.

As cloud use expands and AI takes over routine office work, the resources that need protecting have grown beyond users, devices and servers to include the outside services an AI agent calls and the physical equipment it can command.

The guide names the risks it is aimed at: prompt contamination, and autonomous behavior that goes beyond the authority an agent was delegated. It applies the zero-trust principle the agency summarizes as "Never Trust, Always Verify" to those threats.

Its core instruction is that verification and policy enforcement happen at each point where an agent acts on its own: when it processes an input, calls a tool, delegates a task or communicates externally. Depending on how risky the action is, the guide calls for human sign-off or for a policy that has been approved in advance. Organizations are also given practical benchmarks at each maturity level so they can assess their own security posture and improve it in order of priority.

Companies can read the full document on KISA's website at www.kisa.or.kr.

Lim Jung-kyu, who directs information security and network policy at the ministry, said the timing was right. "With AI use in corporate work increasing, it is timely that a guide for applying zero trust to agentic AI has come out," he said. He added that the government would keep issuing zero-trust application guides alongside its zero-trust security model construction projects, building a base for the model to spread through the private sector on its own.