What Is the Agentic Trust Framework?

TL;DR: The Agentic Trust Framework (ATF) is an open specification that turns Zero Trust into working controls for AI agents. It organizes the job into five elements: Identity Management, Behavioral Monitoring, Data Governance, Segmentation, and Incident Response. I created it and donated it to CSA's CSAI Foundation, and it published in February 2026 under CC BY 4.0.

Last updated October 5, 2026. Rebuilt for verifiedagents.ai by the framework's author, with the numbers from a real 90-day rollout.

What is the Agentic Trust Framework?

The ATF is a governance specification for AI agents. It answers two questions about every agent, all day long: is this agent still who it claims to be, and can you trust what it's about to do. Zero Trust is the constitution. The ATF is the legal code that turns those principles into rules an agent has to follow.

It started with a question I couldn't answer with Zero Trust alone. A healthcare security team ran an AI agent that read thousands of medical images a day. They asked me: how do we know it hasn't been compromised when it looks like it's running normally? Standard Zero Trust verifies the connection. It doesn't check the meaning of what an agent is about to do. The ATF fills that hole.

I donated the framework to the CSAI Foundation, CSA's nonprofit for AI agent accountability, and it published in February 2026 under a CC BY 4.0 license. Anyone can read the full specification at agentictrustframework.ai.

How is the ATF different from Zero Trust?

Zero Trust stays intact underneath. Its rule, never trust and always verify, applies to an agent the way it applies to a person. The ATF adds the layer agents require: verification at the level of each action, because an agent's behavior changes with every instruction it reads.

So the two aren't competitors. Zero Trust verifies the connection. The ATF verifies the actor's conduct. If the vocabulary here is new, what AI agent security is covers the ground floor.

What are the five ATF elements?

Five elements, built to react to each other like sensors in a car. When one spots trouble, the others tighten.

Identity Management comes first in almost every rollout. It's the cheapest control to add, tools like Microsoft Entra now assign each agent a unique identity by default, and the other four elements stand on it.

What does a 90-day ATF rollout look like?

Here's one I ran. A client called in a panic: 15 agents making 5,000 decisions a day and moving $2.3 million in inventory with nobody watching. One agent touched 47 different systems. Twelve more agents turned up that IT didn't know existed.

We worked the elements in order. Unique rotating credentials first. Then baselines, which caught our first real problem: an inventory agent moving 30 percent more stock to port facilities because of corrupted traffic data. Then the walls, then a drill.

The biggest mistake I see is securing ten agents at once. Get one perfectly right. The second takes half the time because identity and monitoring are already solved. One client took three months on their first agent and three days on their tenth.

How should you talk about ATF alignment?

Carefully, because the words carry claims. "Aligned with ATF," "designed against ATF," and "maps to ATF" are safe descriptions of work you've done. "ATF-conformant" means a real conformance assessment happened, including the full set of 25 requirements. The ATF is voluntary, so the word is conformant, never compliant. Vendors who say "powered by ATF" are decorating, not conforming.

What can you do about this in the next week?

1. Spend one honest afternoon listing every AI system in the organization. More will turn up than you expect.

2. Mark the agents that touch money or customer data. Those go first.

3. Score yourself against the five elements. Fifteen minutes, gut-honest.

4. Start Identity Management on one high-risk agent before you add the next agent.

Frequently asked questions

Is the ATF only for big companies?

No. The controls you need depend on what your agents do, not on your headcount. A ten-person firm running autonomous agents across its business needs stronger controls than an enterprise running one internal bot.

How long does implementation take?

The basics take about 90 days. A full build-out runs closer to six months. The fastest path is one well-chosen agent first, then templates and repetition.

Who maintains the ATF?

The CSAI Foundation at the Cloud Security Alliance. I chair the framework there as its Founding Chair. The specification is open under CC BY 4.0, so you can adopt it without paying anyone.

Which element should I start with?

Identity Management. Per-agent credentials are cheap and increasingly a platform default, and the other four elements build on them.

Key takeaways

• The ATF turns Zero Trust principles into action-level controls for AI agents.

• Five elements, full names, each with an owner: Identity Management, Behavioral Monitoring, Data Governance, Segmentation, Incident Response.

• A 90-day rollout cut detection from 21 days to 7 minutes in one real case.

• Secure one agent perfectly before you secure ten badly.

• Say conformant, never compliant. The ATF is voluntary.

Score yourself against the framework

The free ATF assessment walks the five elements in about ten minutes and shows what to fix first.

Your agents are making decisions right now. The framework exists so you can prove they're still yours.