By Christian Siegers, of KPMG Netherlands
For much of the digital era, trust followed a relatively simple path.
Users authenticated. Systems verified their identity. Access was granted. From that point onwards, organisations largely assumed that interactions could be trusted until something explicitly invalidated that assumption.
Identity became the foundation of enterprise security. As long as the right person authenticated through the right mechanism, most architectural concerns about trust could be considered resolved. While the underlying technologies evolved significantly over time, the architectural model itself remained remarkably stable. Perimeter security gave way to cloud identity, Single Sign-On reduced authentication friction and Zero Trust challenged implicit assumptions. Yet throughout these developments, the core principle remained the same: trust was established before meaningful activity began.
A recently published framework from NIST and CISA suggests this assumption may be reaching its limits. At first glance, Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587) appears to be a cybersecurity publication focused on authentication tokens, cryptographic signing keys and identity infrastructure. However, beneath the technical guidance lies a much broader architectural observation. Trust is becoming increasingly detached from the moment of authentication itself.
This shift is already visible in cloud-native environments, but it becomes particularly significant in the context of Agentic AI.
Architecture was designed around stable trust relationships
Traditional enterprise systems were built around relatively predictable interactions. Users accessed applications, applications accessed data and business processes followed predefined paths. Trust relationships were typically well understood and changed only infrequently. Once a user had been authenticated and granted appropriate permissions, there was little reason to question whether subsequent actions remained trustworthy.
This predictability shaped not only technology platforms but also governance models. Architecture reviews were performed before implementation. Security controls were validated before deployment. Access rights were assigned before systems entered production. The assumption behind these practices was straightforward: if the organisation invested sufficient effort upfront, behaviour during operation would remain largely within expected boundaries.
For many systems this remains true today. Conventional applications continue to perform tasks that are relatively deterministic, transparent and predictable. Their behaviour is defined primarily during design and implementation rather than during execution.
AI challenges this assumption.
Agentic AI changes the nature of trust
Unlike traditional software, AI agents do not simply follow predefined execution paths. They evaluate context, retrieve information, select tools, invoke services and continuously adapt their behaviour while pursuing an objective. Increasingly, they act on behalf of users and interact with enterprise systems without direct human intervention at every step.
This distinction is important because it fundamentally changes where trust resides.
In a traditional application landscape, trust is predominantly attached to the identity of the user. Once that identity is verified, systems operate under a relatively stable set of assumptions. In an agentic environment, trust becomes distributed across multiple actors. Users, agents, orchestration services, APIs, enterprise applications and knowledge sources all participate in delivering an outcome. What appears to a user as a single interaction may actually involve dozens of independent trust decisions across multiple systems.
As organisations adopt increasingly sophisticated AI solutions, they are effectively creating a new layer of digital actors. These actors consume information, make decisions, initiate actions and interact with systems on behalf of users. Consequently, trust can no longer be viewed solely as an attribute of human identity. It becomes an attribute of a dynamic ecosystem.
The question therefore changes. Historically, organisations were primarily concerned with determining who was requesting access. In the age of Agentic AI, they must increasingly determine whether actions remain trustworthy as execution unfolds.
Authentication is becoming the beginning of a trust decision
One of the more interesting aspects of the NIST guidance is not its focus on authentication, but its focus on what happens after authentication.
The report concentrates on authentication and authorisation tokens. These should not be confused with the tokens commonly discussed in relation to Large Language Models. Instead, they are the digital artefacts used by identity platforms and applications to represent trust after authentication has occurred. Modern cloud services rely heavily on OAuth tokens, OpenID Connect tokens, JWTs and SAML assertions to determine who is permitted to access applications, APIs and data.
The significance of these tokens is often underestimated. Once issued, they effectively become the representation of trust throughout a transaction. In many environments, possession of a valid token is sufficient to gain access to systems and services without re-authenticating. This is precisely why NIST places so much emphasis on protecting tokens throughout their lifecycle. When a token is stolen, forged or misused, the attacker may no longer need to bypass authentication controls because the trust relationship has effectively already been established.
The architectural implication is profound. If trust is represented by artefacts that continue to operate long after authentication has taken place, then trust itself can no longer be treated as a static property established once and subsequently assumed. Instead, trust becomes something that must be continuously evaluated as context evolves.
The security boundary is moving again
Enterprise architecture has experienced several significant shifts in security boundaries during the past decades. Initially, organisations concentrated defensive controls around network perimeters. The rise of the cloud moved those controls towards identities. Later, Zero Trust introduced the principle that access should be continuously verified rather than implicitly assumed.
AI may now be driving the next stage of that evolution.
Much of the discussion around AI remains focused on intelligence. Organisations debate model performance, reasoning capabilities, orchestration frameworks and autonomous behaviour. These topics are undoubtedly important. However, they may not ultimately prove to be the defining architectural challenge.
The more significant challenge may be maintaining trust across increasingly dynamic networks of actors.
As AI systems become capable of interacting with enterprise services, knowledge repositories, external tools and business applications, the effective security boundary shifts once again. It is no longer defined solely by infrastructure or identity. It becomes defined by the trust relationships that connect users, agents, tools and data throughout runtime.
In such environments, understanding who initiated an action is no longer sufficient. Organisations must also understand how authority is being delegated, how trust is propagated and whether the assumptions that originally justified access continue to remain valid.
Runtime behaviour requires runtime trust
This challenge mirrors a broader trend that is emerging across enterprise architecture.
In earlier work, I argued that governance is steadily moving from design-time towards runtime. Organisations are discovering that reviewing a solution before deployment does not necessarily provide visibility into how that solution behaves once operating autonomously. AI increasingly makes important decisions during execution rather than during implementation.
Trust appears to be following a similar path.
Historically, trust was established before execution began. In increasingly autonomous environments, trust must be evaluated during execution itself. The question is no longer whether an identity was valid at a specific point in time. The question is whether that trust relationship remains valid given the current circumstances.
A user may authenticate through approved mechanisms and subsequently become compromised. An agent may interact with new data sources that alter its risk profile. A context that appeared acceptable at the beginning of a transaction may become unacceptable as new information emerges. None of these scenarios invalidate the original authentication event. They simply demonstrate that trust cannot be reduced to authentication alone.
This is why NIST places significant emphasis on continuous monitoring, lifecycle management, token validation, revocation mechanisms and context-aware access decisions. These controls are not simply security recommendations. They are architectural responses to an environment in which trust itself becomes dynamic.
Trust is becoming an enterprise capability
One of the recurring patterns in technology evolution is that supporting capabilities gradually become strategic capabilities.
Data followed this trajectory. What was once considered a technical concern became a business-critical asset requiring governance, ownership and architecture. More recently, resilience has undergone a similar transformation as organisations recognised that operational continuity depends on architectural choices rather than operational processes alone.
Trust appears to be following the same path.
Historically, identity management was often viewed as supporting infrastructure. Authentication platforms, access management systems and directories typically existed within specialised technology domains. Agentic AI challenges that separation.
Increasingly, trust influences how authority is delegated, how accountability is maintained and how autonomous behaviour remains governable. Questions that once belonged primarily to security teams are becoming concerns for enterprise architects, platform leaders and governance functions.
How should autonomous actors obtain authority? How should trust be propagated between systems? How can accountability be maintained when decisions span multiple services and agents? How should authority be withdrawn when risk changes? These questions extend far beyond identity management.
They are becoming fundamental architecture questions.
From identity management to trust architecture
Viewed through this lens, the significance of NIST IR 8587 extends well beyond token protection.
The report highlights a reality that is becoming increasingly visible across modern digital ecosystems. Successful authentication is no longer sufficient to sustain trust. Trust must be established, delegated, monitored, reassessed and, when necessary, revoked. Maintaining trust therefore becomes a lifecycle concern rather than a point-in-time activity.
As organisations move from isolated AI assistants towards ecosystems of autonomous agents, this distinction becomes increasingly important. Identity remains an essential foundation. Yet identity alone cannot address the dynamic nature of trust within autonomous environments.
The architectural challenge is no longer simply managing identities. It is designing and governing trust itself.
Looking beyond intelligence
The AI industry remains heavily focused on intelligence. New models, improved reasoning capabilities and increasingly sophisticated agents continue to attract significant attention. Such developments are important and will undoubtedly shape the next generation of enterprise applications.
However, history suggests that transformative technologies rarely become constrained by their most visible capabilities. More often, they become constrained by the supporting disciplines required to govern them effectively.
As organisations move towards increasingly autonomous operating models, trust may emerge as one of those disciplines. The challenge is no longer simply determining what an AI system can do. The challenge is maintaining confidence that autonomous systems continue to operate within the boundaries intended by the organisation, even as context, objectives and relationships evolve over time.
The future of enterprise AI may therefore depend less on intelligence than many expect. It may depend on something far more fundamental. The ability to establish, maintain and govern trust across a growing ecosystem of users, agents, applications and data.
In that future, trust architecture may prove just as important as AI architecture itself.