# How Kong and AWS Enable Zero Trust AI Security for Agentic Workloads

This session explains how AWS and Kong approach zero-trust security for agentic AI systems, especially for enterprise environments where agents span APIs, tools, clouds, and internal services. The speakers argue that agent-driven workflows create new risks beyond traditional microservices, including uncontrolled tool access, indirect prompt injection, confused deputy problems, privilege escalation, and poor visibility into who can call which agentic API. Using a coffee-ordering demo app on Amazon EKS, they show how Kong’s MCP proxy can expose existing OpenAPI-based services as MCP tools while keeping authorization decisions at the gateway. The recommended pattern is to validate identity at the edge, deny tool access by default, and exchange broad user tokens for short-lived, audience-bound downstream tokens so agents never hold long-lived secrets or pass user tokens through unchanged. They also stress applying the same controls to agent-to-agent traffic, logging every token exchange for auditability, and combining Kong with services such as Amazon Bedrock Guardrails, Amazon Verified Access, and selected Amazon AgentCore components.