Zero trust microsegmentation limits which services, workloads and network paths an AI agent can reach. It does not secure agentic AI on its own. Securing agents means layering network boundaries with narrowly scoped agent identities, tool permissions enforced outside the model, monitoring, and approval for sensitive operations.
The guidance behind this approach comes mainly from NIST’s zero trust publications and OWASP’s agent-security material. The implementation sequence later in this article is an editorial synthesis of that guidance, not a step-by-step procedure that either organization prescribes.
As an Amazon Associate I earn from qualifying purchases.
What zero trust changes for an agent
NIST SP 800-207 frames zero trust around protecting resources rather than trusting network position. Access is not granted implicitly because a subject or asset sits inside the corporate network, and each access decision is evaluated rather than assumed. For an agent, this means that running inside the perimeter, sitting in the company’s cloud account, or holding a valid service credential does not by itself entitle it to read a database, call an internal API or send an email.
The practical consequence is that an agent should be treated as a subject with its own identity, separate from the developer or employee who deployed it. Its tools, data stores and APIs are resources that need explicit policy. NIST’s cloud-native guidance in SP 800-207A extends this model to applications and services, where nonhuman identities are access subjects in their own right.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Where microsegmentation fits
Microsegmentation is one implementation approach within zero trust architecture, not a synonym for it. NIST SP 1800-35 documents several approaches, microsegmentation among them, and maps example builds to commercially available technologies. Those builds are implementation references, not product endorsements.
The same document reports 19 example zero-trust implementations built by the National Cybersecurity Center of Excellence and its collaborators, and the NIST summary lists 24 collaborators. These are counts of laboratory builds. They do not show how widely these designs are deployed in production or how the approaches compare on security outcomes.
For an agent, the job of microsegmentation is narrow. If an agent runtime should only reach a ticketing API and one read replica, the policy should deny every other path, including an internal administrative network that happens to be routable from the same subnet.
Free tools Windows power users keep installed
One-click scans. No signup required.
What microsegmentation cannot decide
The main risk is treating network reach as authorization. The table shows what each control layer decides and what it leaves open.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
| Control layer | What it decides | What it leaves open |
|---|---|---|
| Microsegmentation (network and workload policy) | Which services, workloads and paths the agent runtime can reach | Whether a permitted call is authorized, and whether the instruction behind it is trustworthy |
| Agent identity and tool authorization | Whether this agent, acting for this user in this session, may run this operation on this target | Whether the model was manipulated into requesting the operation |
| Input handling | How instructions embedded in ingested content are treated before they influence the agent | Whether a permitted action is the right one for the business |
| Human approval | Whether a specific sensitive or irreversible operation proceeds | Routine calls that fall below the approval threshold |
| Monitoring | Whether actions and flows are recorded so they can be reviewed later | Stopping an action in real time on its own |
The agent-specific risks segmentation leaves open
Indirect prompt injection
NIST’s technical blog on agent hijacking describes indirect prompt injection as malicious instructions embedded in data an agent ingests, such as a web page, email or document, which the agent then acts on. NIST discusses identifying and measuring this risk to support mitigation. A network policy typically sees endpoints and packets, not the provenance of an instruction. An agent allowed to reach a file share and an outbound email service can therefore be steered into using both, and the traffic will look permitted.
Tool misuse and excessive autonomy
OWASP’s AI Agent Security Cheat Sheet lists tool misuse and excessive autonomy among the relevant risks. Tool misuse happens when a legitimately reachable tool is used for a purpose it was not meant for. Excessive autonomy happens when an agent takes consequential steps without a check. Both occur on an allowed path, so changing which networks the agent can reach does not change the outcome.
Exfiltration, memory poisoning and cascading failures
The same OWASP material identifies data exfiltration, memory poisoning and cascading failures. Exfiltration can travel over an outbound channel the agent is permitted to use. Memory poisoning corrupts state the agent relies on later, so the harmful input may arrive long before the harmful action. Cascading failures spread when one agent’s output becomes another agent’s input. Controls for these sit at the data, identity and workflow levels as well as in network policy.
Implementation sequence
Work through these steps in order. Each one depends on the inventory produced in the first.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Step 1: Inventory agents, identities, tools and paths
List every agent process, the identity it runs under, each tool and API it can call, the data stores it reads or writes, and the service-to-service paths it uses. Record the user or business process each agent acts for, because that relationship determines what authorization should later bind to.
Step 2: Scope each agent to its task
Give each agent the minimum tools its job requires. Separate read operations from write and other high-impact operations, and scope each permission to specific resources rather than an entire system. A ticket-triage agent, for example, might read one queue and draft replies, while the ability to issue refunds sits with a separate agent or a human-approved step.
Step 3: Enforce authorization in the tool-execution layer
Place the authorization check in the backend or tool-execution component, where the actual call is made. The decision should bind the user, agent, session, operation and target resource together, so a permission granted for one customer’s record cannot be reused against another. A rule that exists only as prompt text, such as “never issue refunds above $100,” is guidance to the model rather than enforcement. The execution layer should refuse an out-of-policy call even when the model requests it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesStep 4: Map flows, then deny everything else
Document the communication flows each agent needs, then use microsegmentation or an equivalent control to deny unneeded paths between agent workloads and enterprise resources. Before enforcing a deny-by-default policy, observe actual traffic and compare it with the intended policy. Discrepancies show either an undocumented dependency that should be added deliberately or an unneeded path that should be removed.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Step 5: Pair network controls with identity-aware policy
For cloud-native workloads, NIST SP 800-207A moves policy from network parameters toward identity-based rules for applications and services. Use that model alongside network controls. A subnet or IP address alone does not establish that a caller is the agent you intended, so the policy should also check the workload’s verified identity.
Step 6: Monitor, gate sensitive actions and review
Log agent actions with enough context to reconstruct who the agent acted for, which tool ran and against which target. Require approval from a separate party for sensitive or irreversible operations, such as payments, deletions or external disclosures. The approver should see the proposed action and its target, not only the agent’s own summary of it. Review permissions and flows whenever a tool is added, a workflow changes or the deployment context shifts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to compare segmentation options
NIST describes several zero trust implementation approaches, and the guidance does not establish that one is universally best. When you evaluate options, compare them on these five criteria:
- Enforcement layer and coverage. Does the option segment networks and workloads, or does it add identity governance, a software-defined perimeter (SDP) or secure access service edge (SASE) controls? Check which agent paths each layer actually covers.
- Identity- and application-aware policy. Can the policy express who or what is calling, on whose behalf, and against which application, rather than only source and destination addresses?
- Visibility and validation. Can it show observed flows and check them against intended policy before enforcement?
- Integration. Does it work across your cloud and on-premises systems and in the runtime where the agents execute?
- Operational complexity. Who maintains the policy as tools and workflows change, and how many rules does that require?
Where the evidence stops
The guidance discussed here is current only as of its publication dates: NIST SP 800-207 (2020), NIST SP 800-207A (September 2023), NIST SP 1800-35 (final version June 10, 2025), NIST’s agent hijacking blog post (January 17, 2025), and OWASP’s Securing Agentic Applications Guide 1.0 (July 27, 2025), which serves as a practical companion to OWASP’s agent-security cheat sheet. Agent security is changing quickly, so check for later revisions before relying on specific wording or control names.
The sources do not provide prevalence or efficacy statistics for agent segmentation, so this article does not estimate how often these controls prevent incidents. Agent workflows also differ. A summarization agent that reads public documents, a finance agent that initiates payments and a coding agent with repository write access need different policy boundaries. Match each boundary to that agent’s actual resources, trust relationships and operating context rather than applying one template to every agent.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
