An Action-Centric Zero Trust Maturity Model for Agentic AI Environments

Abstract

Large language model–based agentic AI systems can independently interpret user goals, develop plans, and interact with external tools. These capabilities introduce security concerns that extend beyond traditional access control. However, existing Zero Trust Maturity Models, such as the CISA ZTMM, mainly focus on how resources are accessed and provide limited guidance on how to evaluate actions taken after access has been granted. This paper proposes AI-ZTMM, which extends CISA’s five-pillar structure to action-level trust evaluation. The model defines forty-one security Functions based on ten threat categories and thirty-one security requirements and introduces Action Space and seven Action Risk Factors for organizational self-assessment. Its scope includes software agents and the software action layer of agents in IoT, robotic, and OT/ICS environments. The model was refined through reviews by eleven domain experts and evaluated using thirty-eight MITRE ATLAS case studies. The CISA ZTMM lacked directly relevant controls for 59.7% of the analyzed attack stages, whereas AI-ZTMM addressed 75.4% of this gap, achieving a combined direct coverage of 84.4%. These results show that AI-ZTMM complements the CISA ZTMM by providing action-level security controls.