Zero Trust Architecture for Generative AI: Securing Prompts, Retrieval, and Agent Tool-Use in Regulated Environments

Abstract

The deployment of generative AI systems in controlled contexts presents an entirely enlarged attack surface: The use of prompts, retrieval pipelines and agentic tool invocations are all unique and consequential authorization events that cannot be regulated by perimeter security controls. Zero Trust Architecture offers the conceptual basis needed to overcome these issues with a requirement to do policy review on a per-request basis based on verified identity, device posture, and real-time risk indicators as opposed to implied session trust. An architecture that can be defended as ZT-GenAI necessitates coordinated enforcement across five interdependent control layers: Prompt Envelope integrity validation, Attribute-Based Access Control governed retrieval, token-level Redaction Gates, Tool Broker intermediation with scoped token issuance, and workflows of supervisory approval of high-impact agentic actions. Such an architecture can be evaluated through injection resilience testing, policy effectiveness testing, audit completeness testing, operational latency sensitivity testing, and so on, and the evidence they produce can be the basis of regulatory defensibility and model risk governance. The architectural designs shown herein provide a repeatable template for implementing generative AI capabilities into sensitive operational settings without any authorization rigor or auditability sacrifices.