“AI agent actions must be verified step by step,” government prepares Zero Trust guide

[Financial News] The government has drawn up new security guidelines in response to the spread of “agentic AI,” in which artificial intelligence (AI) makes decisions and performs tasks on its own. The key is to verify AI agents’ autonomous actions, such as calling tools and delegating tasks, at each step and require human approval based on the level of risk.
The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) said on the 6th that they had prepared the “Agentic AI Zero Trust Guide” after gathering input from experts across industry, academia and research, among other steps.
Agentic AI is technology that goes beyond simply analyzing and generating information to make decisions on its own and use external tools to perform tasks. As businesses expand their use of AI, the scope of security controls is widening to include not only existing users, endpoints and servers but also external services and physical devices accessed by AI agents.
In particular, because AI agents perform tasks autonomously with high-level access privileges, they may be exposed to new security threats, such as prompt poisoning or actions that exceed the permissions delegated to them. In response, the government has established specific criteria for applying the “Zero Trust” security principle—which requires continuous verification of all access—to agentic AI environments. Zero Trust is a security concept based on the possibility that a network has already been compromised, and it calls for the continuous verification of every access request without distinguishing between internal and external.
Based on the “Zero Trust Guidelines 2.0,” announced in December 2024, the new guide expands the existing four-stage security maturity model to suit agentic AI environments.
The government has stipulated that verification and security policies be applied at each major stage of an AI agent’s actions, including input processing, tool calls, task delegation and external communications. It also sets out ways to require human approval based on the level of risk or control actions according to policies approved in advance.
The guide also sets out practical criteria for each maturity level so businesses can assess their own security and identify areas for improvement. It outlines considerations for adopting Zero Trust, operational procedures for each stage and real-world examples, enabling businesses to use it from adoption through operation and improvement. The full guide is available on the KISA website.
Im Jeong-gyu, the Ministry of Science and ICT’s Director General for Information Security and Network Policy, said, “The government will continue to lay the groundwork for the voluntary adoption of Zero Trust in the private sector by carrying out projects to build Zero Trust security models while also publishing guides on applying Zero Trust.”


[email protected] Choi Hye-rim Reporter