Starting in late December 2025, a single attacker convinced Claude Code that a hacking campaign against nine Mexican government agencies and a financial institution was an authorized penetration test. The account was real and properly authenticated throughout: the attacker never stole any credentials and never had to break an authentication check to make any of it work. Over the following month, more than 1,000 prompts turned into thousands of individual commands across dozens of sessions, and the agent exfiltrated more than 150GB of data, roughly 195 million records pulled from the country’s tax authority, civil registry, and electoral institute, among other targets.
Every identity and authorization check passed. The agent was who it said it was, and it had every right to do what it did, one step at a time. The intrusion lived in the sequence, not in any single action. That’s the problem with governing agentic AI through identity and authorization alone: those controls answer “is this agent allowed to do this,” and an agent chaining together thousands of individually permitted actions can still produce an unexpected, unwanted, and unauthorized outcome. Identity and authorization are necessary but incomplete for a system that acts, plans, and chains calls together faster than any human can follow.
The question identity and authorization answer
Authentication confirms an agent is who it claims to be. Authorization confirms that agent can call this API, read this file, or invoke this tool. Both operate at the moment of the request, checking a single action against a policy written in advance. That’s exactly what they were built for, and they still matter. An agent with no verified identity or no access controls is a bigger problem than one with both.
But an agent with valid credentials and authorization can still read a malicious file it shouldn’t have trusted, call a tool in an order that produces an unintended side effect, or chain three sanctioned actions into a sequence that isn’t. None of that shows up in an identity log or an access control list, because none of it violates identity or access rules. It shows up in the pattern of what the agent did.
Zero trust must expand to cover agent behavior
Zero trust started as a response to a similar blind spot in network security: stop trusting a user or device just because it’s inside the perimeter and verify every request instead. Agentic AI needs the same shift applied further out, past the identity check, into the actions an agent takes afterward. Never trust an agent’s action just because its identity checked out and its permissions were in scope. Verify what it’s doing, continuously, not only at login or at the first API call.
Agentic zero trust means treating every action an agent takes as something to evaluate on its own merits, and evaluating the sequence those actions form (its behavior). It also means writing policy per agent, not per user. Two agents can share a human owner and still warrant completely different behavioral baselines and policies, because one drafts email and the other moves money, for example. A framework that only distinguishes users from each other, and not agents from each other, is verifying the wrong entity.
Behavior moves at machine speed, so governance must as well
A human analyst reviewing an access log has time to think about it. An agent calling a dozen tools per second doesn’t leave that kind of room. By the time an access review would catch an agent that’s drifted into reading files outside its original scope, that agent has already made tens of thousands of calls.
Watching actions and sequences at machine speed means the evaluation has to happen inline, as the agent acts, comparing what it’s doing right now against what it normally does and what its persona is supposed to do. A single anomalous read might be nothing. The same read, following an unusual sequence of tool calls that ends with data leaving through an outbound channel the agent has never used, is the kind of pattern that a single policy check on any one of those steps would miss entirely.
How Cequence AI Gateway governs agentic AI
The Cequence AI Gateway sits in the traffic path for every agent, every LLM provider, and every MCP server and API an organization uses, and it inspects both the individual action and the sequence that action belongs to. Agent Personas give each agent its own behavioral baseline, limited to what that specific agent is supposed to do, so a finance agent and a support agent get evaluated against different expectations.
The behavioral intent engine powering the AI Gateway doesn’t stop at confirming an action was authorized. It analyzes what an agent does across a session and stops it the moment a chain of individually permitted calls adds up to something outside that agent’s normal pattern, whether that’s an unfamiliar tool combination, a destination it hasn’t used before, or a sequence that resembles data exfiltration rather than the task the agent was built for.
Identity and authorization are still necessary in this architecture. They’re the first check, not the only one. Cequence AI Gateway adds what agentic AI needs beyond that check: continuous, per-agent behavioral governance based on agentic zero trust principles that catches what a static policy check, run once per request, would miss.
