The Six Essentials: 60% Coverage in One Sprint

A team is starting from zero. They have agents in production, no specific Zero Trust framework in place, a security org that has covered conventional infrastructure but not specifically agents, and an executive who wants to see real progress in 90 days.

The conventional answer is adopt a comprehensive framework, build a multi-quarter roadmap, prioritise by risk, deliver progressively. That answer is correct over a 12-month horizon. It is wrong for the 90-day horizon. The team needs progress before the comprehensive framework lands.

There is a different answer. Not the whole framework. The Six Essentials: a small set of practices that together cover roughly 60% of agentic Zero Trust threat surface, can be implemented in one focused sprint, and require no new infrastructure beyond what most security organisations already operate.

The Six Essentials are not the destination. They are the floor — the threshold below which no agent operation should run, and the achievable starting point any team can reach in 90 days.

The Six

1. Identity binding for every agent invocation. Every action your agent takes is bound to a verifiable identity — workload identity at minimum. The identity travels with the action. The action without the identity is rejected.

This is not new infrastructure for most security organisations. SPIFFE, federated tokens, workload identity providers — these exist. The work is to use them for every agent invocation, including the ones that have been running on shared service accounts.

Coverage: about 15% of the surface. Threats it addresses: impersonation, credential reuse, anonymous action.

2. Mandate validation at action time. Every action checks for a valid, signed, scoped, time-bounded mandate authorising it. No mandate, no action.

This is new for most teams — not because it’s hard, but because most teams haven’t built mandate infrastructure yet. The work is small (a few hundred lines of code) and the architectural footprint is modest. The pattern is well-defined.

Coverage: about 12% of the surface. Threats it addresses: prompt injection that issues unauthorised actions, scope creep, replay attacks.

3. Output attestation at the boundary. Every output the agent produces is attested at the boundary where it leaves the agent’s control. Signed, structured, with provenance.

This is the simplest of the six to ship. A signing module on the output path. The hard part is consuming the attestation downstream, which most teams defer to a second sprint. Even just signing without consuming gives you forensic value.

Coverage: about 10% of the surface. Threats it addresses: forged outputs, downstream tampering, source attribution gaps.

4. Forensic ledger posture for every action. Every action goes through an append-only ledger with signed entries. Not telemetry — the ledger. Persistent, queryable, replayable.

This is the most architectural of the six. It requires committing to the ledger as a separate surface from telemetry. For most teams, the ledger ends up backed by an event store they already operate (BigQuery, Kafka with retention, something equivalent). The work is to use it correctly — append-only, signed, structured.

Coverage: about 12% of the surface. Threats it addresses: untraceable failure, audit gaps, attribution after-the-fact.

5. Bounded execution with graduated verdicts. The action layer supports more than do and don’t do. Allow with conditions, bounded execute, deny with evidence — the graduated vocabulary.

This requires changes in the policy and execution layer. Not infrastructure changes, but architectural changes — the policy decision point and policy enforcement point need to support the wider verdict vocabulary, and the execution layer needs to honour bounded executions.

Coverage: about 8% of the surface. Threats it addresses: false-refuse / false-permit cycle, useless-bureaucrat default, scope-creep through implicit execution.

6. Capability-and-consequentiality awareness. Every action carries metadata about the capability class it requires (model class, tool class, mode of operation) and the consequentiality class it sits in. The verdict pipeline uses this metadata to set rigor appropriately.

This is the lightest-weight of the six. It is mostly a metadata discipline — annotating actions with their classes and using the annotations in the policy pipeline. The architectural commitment is small; the discipline is what matters.

Coverage: about 5% of the surface. Threats it addresses: low-rigor defence on high-consequence actions, capability-floor violations.

Why These Six

The Six Essentials are not the most important controls in agentic Zero Trust. They are the minimum coherent set — the smallest collection of practices that together cover a meaningful fraction of the threat surface and reinforce each other.

Each one alone covers some surface. Together, they compose:

• Identity binding gives the foundation for mandate validation (a mandate signed for whom?)
• Mandate validation gives the foundation for output attestation (output authorised by which mandate?)
• Output attestation gives the foundation for the forensic ledger (the ledger records what was attested)
• The forensic ledger gives the foundation for bounded execution (the bound’s deferrals are recorded for review)
• Bounded execution gives the foundation for capability-and-consequentiality awareness (rigor scaling shows up in verdict choice)
• Capability-and-consequentiality awareness loops back to identity binding (which identity for which capability class?)

The six are integrated. Implementing five of them and skipping the sixth leaves a gap that the others cannot fill. Implementing all six gives you a coherent floor — not the whole framework, but a floor that holds.

The 60% Number

The 60% coverage is not a precise measurement. It is an honest range estimate based on the framework’s threat-surface decomposition: across the major threat classes, the Six Essentials produce evidence-based verdicts for roughly 60% of the cases.

The other 40% requires more advanced controls — multi-channel verification, capability-proportional floors at advanced phases, processing-integrity closures for chain-of-thought integrity, situational-awareness defences for evaluation-aware behaviour, and so on. These are real and important. They are also work that takes more than 90 days.

The question is not should we ship the 40% immediately. The 40% requires more time and deeper investment. The question is can we get to the 60% floor in one sprint. The answer is yes, for most security organisations, with the Six Essentials as the structure.

What 90 Days Actually Looks Like

A concrete 90-day plan:

Days 1-15: Identity binding (Essential 1) + scope. Inventory current agent invocations. Identify which are running with workload identity and which are running on shared accounts. Migrate everything to workload identity.

Days 16-30: Mandate format and validation (Essential 2). Define the mandate schema. Build the validation library. Integrate at one high-leverage agent. Stress-test.

Days 31-45: Output attestation (Essential 3) + forensic ledger posture (Essential 4). The ledger comes first; the attestation writes into it. Use existing event-store infrastructure where possible. Sign entries, structure them, ensure append-only.

Days 46-60: Bounded execution and graduated verdicts (Essential 5). Update the policy decision point and policy enforcement point. Pilot on the high-leverage agent from Day 16-30 work.

Days 61-75: Capability-and-consequentiality metadata (Essential 6). Annotate all action classes. Plumb the annotations through the policy pipeline.

Days 76-90: Roll out across the agent fleet. Address gaps surfaced during rollout. Document the floor. Brief the executive sponsor. Measure coverage.

Day 90: the team has the Six Essentials shipped, the 60% floor in place, the forensic ledger producing trail for every action, the verdict pipeline functioning, and the capability-and-consequentiality discipline annotated across the fleet.

This is achievable. It has been achieved. It is the realistic floor that lets the team move from “we have agents in production but no specific Zero Trust posture” to “we have an evidence-based verdict pipeline for every agent action.”

The Disposition

The Six Essentials are not the answer to the comprehensive framework. They are the floor — the minimum below which no agent operation should run, and the achievable starting point that earns the team time to build the rest.

A team that tries to ship everything in 90 days will ship some controls poorly and miss the foundational integration. A team that ships nothing in 90 days because the comprehensive framework isn’t done yet will be operating without a floor while the comprehensive framework is being designed.

The Six Essentials are the middle path: a coherent floor, achievable in one sprint, that gets the team to a defended posture from which the rest of the framework can be built without time pressure.

For the CISO who needs to show progress to the board: this is what 90 days looks like. Real coverage, real architectural commitments, real readiness. Not a promise of future work; a floor in place.

The rest of the framework — the depth, the breadth, the more advanced controls — is the work of the next year. The floor is the work of the next quarter. Ship the floor first. The roadmap from there is straightforward.