Zero Trust Is Outdated. Here's the Doctrine That Replaces It.

Let's give Zero Trust its due before we bury it. Fifteen years ago, the dangerous actor was a stolen laptop on a flat corporate network, and the doctrine that answered it — never trust the network, always verify the identity — was genuinely revolutionary. It killed the perimeter, mainstreamed MFA and micro-segmentation, and made "assume breach" a board-level phrase. Zero Trust won.

And that's exactly the problem. Doctrines calcify at the moment of victory. Ask where enterprise losses actually come from now: the actor authenticates perfectly. The MFA passed. The device was compliant. The session was valid. Then the authenticated actor — a phished employee, a hijacked session token, or increasingly an AI agent with legitimate credentials — did something catastrophic that it was technically authorized to do.

Zero Trust has no answer to this, because Zero Trust interrogates the actor at the door and then trusts every action inside the session. It moved the perimeter from the network to the identity — but it's still a perimeter, and everything inside it is still implicitly trusted.

01Why agents break the doctrine for good

AI agents don't just strain Zero Trust — they invalidate its core assumption. Zero Trust assumes that verifying the identity tells you something about the actions that follow, because human identities have stable intentions. Agents sever that link:

• The identity is real, the instruction isn't. A prompt-injected agent authenticates flawlessly while executing an attacker's intent. Every Zero Trust check passes; the confused deputy walks through the front door with valid papers.
• One identity, a thousand intents. A human's session might contain dozens of actions with one purpose. An agent's session contains thousands of actions whose purposes are set per-task, per-prompt, per-upstream-input. Verifying the identity once tells you almost nothing about action #7,412.
• Machine speed inverts the economics. Zero Trust's residual risk was survivable at human speed: a compromised account does damage at the rate a human can click. A compromised agent does authorized damage at the rate an API can accept it.

The conclusion isn't that verification was wrong. It's that the unit of verification is wrong. Identity was the right unit when actors were people. Now that actors are processes, the unit has to be the action.

02Adaptive Trust Systems: the model

Adaptive Trust is the doctrine we design to at ClearGlass: trust is not a gate you pass, it's a quantity that is computed per action, spent by actions, earned by track record, and priced by consequence. Four components:

1. Action trust — score the verb, not the noun

Every action gets a trust decision computed from three inputs: the actor's track record, the action's consequence class, and the context (source of instruction, time, target). Reading a record and deleting ten thousand records are different trust events even inside the same authenticated session. Zero Trust asks "is this actor verified?" Adaptive Trust asks "does this specific action, right now, deserve to execute without a human?"

2. Intent verification — authorized isn't aligned

Each actor — human role or agent — carries a declared purpose. Actions that are permitted but misaligned with that purpose don't execute; they escalate. The support agent exporting the full contact table has valid credentials and an invalid intent, and the intent check is the only one of the two an attacker can't hijack from the outside. This is the control that turns prompt injection from a breach into a logged, denied request.

3. Learning policy — the doctrine that updates itself

Static policy is dead policy: it's wrong the day after it's written and nobody amends it until an incident. In an adaptive system, policy consumes its own audit ledger. An agent with a six-month clean track record in WRITE-tier actions earns wider rate limits — automatically and reviewably. An actor implicated in an anomaly gets its autonomy shrunk to READ until a human re-expands it. Trust becomes an asset with a history, not a checkbox set at provisioning.

4. Trust economics — make catastrophe unaffordable

The most practical component: give every actor a trust budget and every action class a price. Low-consequence actions are nearly free. Irreversible ones — money movement, mass deletion, external sends, credential changes — are priced above any single actor's balance, so they structurally require a co-signer: a human approval or a second independent system. Nobody, human or machine, can afford a catastrophe alone. Budgets replenish with track record and drain with anomalies, which means the system's generosity is always collateralized by history.

03What this looks like in practice

If this sounds familiar, it should: it's how mature societies handle every other dangerous capability. New drivers get provisional licenses. Junior traders get small books. Nobody launches alone. Security is the last discipline still pretending that a one-time identity check at the door is a theory of trust.

04Migrating without ripping anything out

1. Keep Zero Trust as the floor. Identity verification, MFA, micro-segmentation stay. Adaptive Trust is a layer above them, not a replacement for authentication.
2. Classify actions by consequence. READ / WRITE / IRREVERSIBLE across your top systems. This taxonomy is the price list for everything that follows.
3. Declare purposes. Every role and agent gets a one-sentence purpose. You can't verify intent that was never declared.
4. Stand up the ledger. Append-only, action-level, with the triggering instruction. The learning policy is only as good as the history it learns from.
5. Price the irreversible tier first. Co-signing on money movement, mass deletion, and external sends delivers most of the risk reduction for a fraction of the effort.

Zero Trust was the right doctrine for the identity era, and the industry owes it a debt. But doctrines are answers to questions, and the question has changed. It's no longer "should this identity be here?" It's "should this action happen?" — asked millions of times a day, mostly about actors that were never born. The organizations that answer it systemically will run agents their competitors can't afford to trust.