Agentic-ZTA: A Multi-Agent Architecture for Autonomous Zero Trust Enforcement

What it is

Agentic-ZTA, proposed by Roy, Praharaj, Gupta, and Thuraisingham (Tennessee Tech, UNC Pembroke, UT Dallas), instantiates the NIST SP 800-207 PDP/PEP control loop as nine specific LLM agents: a Policy Engine (PE) orchestrator plus eight domain agents — IAM, PKI, Threat Detection, Compliance, CDM, Activity and Log, Data Access Policy, and SIEM.

How it works

The PE agent holds no domain knowledge itself; it only receives the enriched request, decides which core/supporting agents to invoke, and collects their verdicts. Each domain agent is grounded in its own RAG pipeline over authoritative telemetry, retrieving fixed top-k policy context at inference time. To control LLM non-determinism, all agent inference calls use greedy decoding (temperature=0) combined with fixed top-k retrieval — explicitly cited as the mechanism for reproducible, auditable decisions despite using LLMs.

The enforcement logic is asymmetric: any single core agent DENY verdict triggers immediate PEP enforcement, bypassing further evaluation. An ALLOW outcome instead requires multi-agent consensus via the trust-fusion algorithm. This means a compromised or faulty agent can only cause denial-of-service, never unilaterally grant unauthorized access — the paper frames this as a separation-of-duties guarantee.

flowchart TD
    A[Access request via PEP] --> B[Policy Engine agent]
    B --> C[Core agents: IAM/PKI/SIEM/etc]
    C -->|Any DENY| D[Immediate PEP enforcement: deny]
    C -->|All ALLOW| E[Trust-fusion consensus]
    E --> F[PEP enforcement: allow]

Preconditions / Affected

Applies to deployments building LLM-agent-based PDPs, specifically where continuous, auditable zero-trust enforcement is required — the paper names Internet of Battlefield Things (IoBT) as a motivating environment with intermittent connectivity and dynamic policy needs.

Caveats

The authors position this against prior work (Table 1 in the paper) and claim no surveyed system combines multi-agent orchestration, RAG grounding, and autonomous enforcement together — this is the paper's own competitive framing, not independently verified. The reported 95.0%/93.9%/96.3% (accuracy/precision/recall) figures, already in the catalog summary, come from the authors' own testbed on scenarios they selected; no third-party reproduction is mentioned. The paper also states three research questions (accuracy, auditability, latency) that the fetched excerpt does not resolve with results — only the architecture and rationale are covered here.