An AI assistant may need to read a project folder without being allowed to email its contents outside the organisation. Once an assistant can use tools, security teams have to enforce that distinction throughout the task, including when the model encounters misleading instructions in a document.
Microsoft’s 19 March Zero Trust for AI announcement puts those access boundaries at the centre of an updated set of workshops, assessment tools and reference guidance. The company is extending its existing security approach across data ingestion, model deployment and agent behaviour.
Different tools are at different stages
The release adds an AI pillar to Microsoft’s Zero Trust Workshop, alongside a new reference architecture and practical security patterns. The automated Zero Trust Assessment gains Data and Networking pillars in addition to its existing Identity and Devices coverage.
The AI-specific assessment pillar has a different status: Microsoft says it is in development for summer 2026. Teams evaluating the announcement should distinguish the workshop material available now from that planned automated assessment. An organisation cannot infer that an assessment tool already tests every AI control simply because the broader programme now includes AI guidance.
Microsoft organises the approach around explicit verification, limited permissions and preparation for a breach. In practice, those principles require decisions about the identities used by agents, the sources they can read, and the actions they can execute.
Make permissions enforceable outside the prompt
Consider an assistant preparing a supplier briefing. It might legitimately need access to approved product documents and a calendar, but no ability to change payment details. Giving it an unrestricted account and asking it to behave carefully leaves the account’s broader powers available if the task goes wrong.
A narrower identity and tool permission set creates an enforceable boundary. Logging then needs to connect an action with the task and identity that authorised it, so a reviewer can reconstruct what happened. Microsoft’s announcement includes guidance on agent lifecycle management, observability and indirect prompt injection as parts of this wider approach.
These controls do not establish that a model’s answer is accurate. They limit the resources and actions available while it produces that answer. Organisations still need a suitable review process for the decisions they delegate.
The immediate work is to identify a real workflow, list the data and actions it requires, and compare that list with the permissions actually granted. The workshop can structure that discussion; its existence alone does not verify an organisation’s configuration.
Find related reporting in Tech & Security.
Questions
Is Microsoft’s automated AI assessment available?
The March announcement schedules the AI-specific pillar for summer 2026; the workshop’s AI guidance is a separate release.
What does least privilege mean for an AI agent?
The agent receives only the data access and tool permissions needed for its defined task.
Do access controls verify an AI answer?
No. They restrict what the system can access or change; factual review remains a separate task.
