[geoctl]

I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already been in use for years when it comes to anomaly detection. Maybe modern LLMs can be used to automate access control, partially or fully at enterprise scale in the future. The idea is to have a policy engine that's controlled by AI that uses a mix of long-term semi-static info such as group memberships and permission boundaries, short-term info such as behavior (e.g. access logs) and current session's authentication strength level (AAL) such as FIDO as well as near real-time external information (e.g. IdP, SIEM, threat intelligence, on-call management) to dynamically adjust users' access control to build up some sort of a context for each user and each session that can increase or decrease permissions without having to manually add policy rules or going through request/approval flows, while optimizing for the main objective (i.e. minimizing access grants for every subject to any resource under whatever context unless when it's necessary). This can be unified for both humans and non-human identities, including agents.

[rossjudson]

Good, realistic take. There's a lot of context that can be drawn on to make better decisions and look for weird.

And then agents come along and some people want their agent to be able to do anything they can do with zero friction. That usually lasts until the first time something goes wrong ;)

[geoctl]

Actually zero trust can be seen as an optimization problem, you almost certainly want to globally deny every single request, even for authenticated users under all circumstances to all resources, unless when "necessary", "necessary" here is the key because it needs to be as dynamic and as fine-grained as possible, context-based and scalable. For small businesses, RBAC and ACL rules can be fine, but for enterprises with thousands or tens of thousands of employees, contractors and now AI agents which need varying permissions to different resources at different times, you would have to define thousands or tens of thousands of rules that might conflict with one another and are hard to maintain. ABAC and policy-as-code can mitigate to a certain extent providing dynamic context-based fine-grained access control. But if you could gather as much information as possible about every user and every session, combine it with some boundary permissions and static rules, and feed it periodically to some reasoning engine that is tasked with dynamically increasing/decreasing permissions for each session based on all such info, you can keep your manual/static access control policies to a minimum and maybe even eliminate JIT in some cases. The real question is whether modern LLMs and transformers are the correct and optimal architecture for this problem in the first place.