Evolving Zero Trust: From Original Planes to Modern AI-Era Architecture

Abstract

Zero Trust was developed for environments dominated by human users, managed devices, and traditional networks. Today’s enterprises operate across cloud platforms, SaaS applications, APIs, microservices, automated workloads, and autonomous AI agents, challenging assumptions behind earlier Zero Trust models. This paper proposes a modernized reference architecture aligned with NIST SP 800-207 and the CISA Zero Trust Maturity Model 2.0. It explains why the traditional Device Plane is no longer sufficient and introduces an expanded Entity Plane that includes devices, workloads, service accounts, APIs, and AI agents. The paper also makes enforcement an explicit architectural concern, expands policy and data considerations for distributed environments, and examines the security implications of non-human identities and agentic AI. It provides a practical migration path and maps common security technologies to the proposed model. Intended for security architects, CISOs, engineers, auditors, governance professionals, and technology decision-makers, it offers a practical framework for evolving Zero Trust while remaining grounded in recognized industry standards.

The short version.

• 01Core Challenge: Traditional Zero Trust models were built for users and devices, but modern enterprises now rely on cloud services, APIs, workloads, and AI agents.
• 02Key Limitation: The Device Plane alone cannot adequately evaluate non-human entities such as service accounts, workloads, APIs, and autonomous AI agents.
• 03Major Evolution: The paper expands the Device Plane into an Entity Plane that evaluates all entities, human and non-human, using appropriate trust signals.
• 04New Architecture: Enforcement becomes a distinct Enforcement Plane, reflecting modern distributed controls across cloud, SaaS, network, application, and data environments.
• 05AI Impact: AI agents challenge device-centric security assumptions and require identity lineage, behavioral monitoring, and distributed enforcement controls.
• 06Practical Adoption: A phased migration path allows organizations to evolve existing Zero Trust programs without disrupting current device-based protections.
• 07End Goal: The modernized model remains aligned with NIST SP 800-207 and CISA ZTMM 2.0 while providing a more practical architecture for today's enterprise realities.