ZERO TRUST FOR AI AGENTS
ENTERPRISEAI agents need network access. Give them identity, not keys to the building.
Tunnex is the self-hosted Zero Trust VPN that treats AI agents as first-class principals: owned credentials, port-scoped access to MCP servers, grants that expire on their own, and an audit log that names them.
THE PROBLEM
Today there are two ways to give an agent access. Both are bad.
THE LOCALHOST TRAP
Safe because useless
MCP servers locked to localhost cannot be reached by anyone — including the agents that need them. The moment your team is remote or the agent runs in a container, localhost stops working.
THE BEARER-TOKEN LEAK
Useful because exposed
Put the MCP server on the public internet behind a token and any holder of that string gets in. No device identity, no network boundary, no expiry, no attribution.
THE TUNNEX PATH
Reachable and bounded
The MCP server stays inside your network. Agents connect over WireGuard as named principals, scoped to specific hosts and ports, with grants that expire on their own.
HOW IT WORKS
An agent is a principal that runs unattended, at machine rate.
01
Issue an owned principal
Every agent gets its own credential, linked to a human account, with a non-operator role. It costs a device seat and appears in your audit log from birth.
02
Scope what it can reach
Policy names the destinations — MCP server, host, CIDR, port — and nothing else. Rules compile to the same default-deny artifact that governs human devices.
03
Let access expire
Grants carry an expiry that sweeps itself. Extend in place when the work continues; do nothing and the access is gone — no stale credentials to hunt later.
CAPABILITIES
Everything an agent governance layer owes you.
Owned principals
No ownerless machine credentials. Every agent principal belongs to a human account and sits inside the accountability chain.
Non-operator roles
An agent role can connect; it cannot write access rules. A compromised agent cannot grant itself what it was denied.
Time-boxed grants
Access is a rule with an expiry that sweeps itself automatically. Thirty-minute grants need no new mechanism.
Port-scoped MCP destinations
Scope Model Context Protocol servers by host, CIDR, and port. The agent reaches the tool, not the subnet around it.
Attributed audit log
Agent network requests are attributed to the agent and linked to initiating triggers — never a blank field in the log.
One engine, not a second door
Agents are subjects in the same compiled policy artifact as people and devices. No parallel stack, no exception list.
OPERATE THE FLEET
Enrollment to retirement, without SSH.
Guided enrollment & bootstrap tokens
One-time hashed enrollment tokens with expiry; copyable install commands for Linux packages and containers.
Runtime sync & safe rotation
Desired-versus-applied config revisions with fail-closed handling, plus automatic WireGuard key rotation with bounded overlap.
Fleet scale on one gateway
Multiple agents per gateway with organization quotas and atomic tunnel-address allocation under concurrent enrollment.
Read-only Test Access diagnostics
Pick an agent and destination; get a step-by-step pass/fail across identity, policy, route, gateway, DNS, port, and expiry — naming the exact blocker.
Groups & reusable policy templates
Versioned templates with resolved-policy preview before applying — reusing the same compiler, never a parallel model.
JIT approval inbox
Agents request access with destination, reason, and duration (5 min–24 h); administrators approve from an inbox. Emergency revoke included.
Alerts, webhooks & SIEM export
Signed, retryable agent-event delivery with attempt history — extendable to gateway, site, and Kubernetes health.
STATED PLAINLY
What a network boundary does, and does not do.
Zero Trust bounds the blast radius of a correctly authenticated principal. It does not detect prompt injection. Under injection, authentication is intact and authorization is intact — only intent is corrupted. That is exactly why agent access must be scoped and time-boxed before the agent ever connects: the boundary holds even when the agent's mind does not.
QUESTIONS
AI agent access, answered directly.
How do I control what an AI agent can reach on my network?+
You write a Zero Trust rule whose subject is the agent principal and whose destination is a scoped resource — an MCP server, host, CIDR, or Kubernetes service, down to specific ports and protocols. Everything else is denied by default at the gateway kernel.
What happens if an AI agent is prompt-injected?+
A prompt injection corrupts intent, not authentication. Tunnex cannot detect the injection, but network-level default-deny bounds the blast radius: the compromised agent keeps only its already-scoped access and cannot pivot to unauthorized internal infrastructure.
Do AI agents share the operator’s credentials?+
No. Each agent is issued its own non-human principal with a non-operator role. A machine credential that could write access rules would invert the threat model, so agent roles can connect but cannot modify policy.
How do agent access grants expire?+
Grants are rules with an expiry timestamp. A background sweep removes expired grants along with the peer slot and pool address. Extending access moves the expiry in place — there is no delete-and-recreate dance.
Can I audit what an AI agent did?+
Yes. The audit log carries first-class system actors, so every agent request and policy change is attributed to the specific agent principal and linked to its initiating trigger.
How do agents enroll without manual setup?+
Enrollment uses one-time hashed bootstrap tokens with expiry, consumed on first use and bound to the intended organization and gateway. A guided wizard provides copyable installation commands for Linux packages and containers, with progress state until the agent reports active.
Can agent events feed our SIEM?+
Yes. Agent events ship as signed, retryable webhook deliveries with attempt history, and audit export preserves tenant isolation — so your existing monitoring and compliance tooling sees the same evidence the console does.
Scope your agents before they scope themselves.
Install the server, issue your first agent principal, and watch every request land in the audit log attributed by name.