Phase 0 Is the Floor, Not the Ceiling

Most maturity models are climbing models. You start at level 1, do specific work, get to level 2, do more work, get to level 3, and so on. Each level builds on the previous. Each phase has more controls than the last.

This works as a description of progress. It misses something structural: the floor. The level below which no operation should run, no matter how new, no matter how small, no matter how exploratory.

For agentic Zero Trust, that floor is Phase 0. It is not “level zero” in the climbing-model sense — not the absence of capability, not the starting point you grow out of. Phase 0 is the universal floor: the practices that everyone deploying agents should operate from, regardless of their maturity stage, regardless of their resource budget, regardless of their organisational size.

Phase 0 is not optional. It is also not infrastructure. It is discipline that travels with the practitioner.

What Phase 0 Is Not

Phase 0 is not “Phase 1 with less rigor.” It is not “what you do when you can’t afford the real controls.” It is not “the entry-level tier.”

It is also not infrastructure. Phase 0 does not require:

• A specific policy engine
• A specific identity provider
• A specific event-store backend
• A specific framework or platform
• A specific budget
• A specific team size

These are misreadings of the phase. They imagine Phase 0 as the cheap version of higher-phase work. It isn’t.

Phase 0 is the disciplines that make the rest of the framework possible. Without them, the higher phases don’t compose. With them, the higher phases compose smoothly.

What Phase 0 Is

Three disciplines define Phase 0. Each is implementable today, with no new infrastructure, by any team operating agents:

1. Distinguish the agent from the user. Whatever your authentication and authorisation looks like, the agent is not the same actor as the user the agent is acting for. The agent has its own identity. The agent’s actions are attributable to the agent, not silently to the user. The user retains the right to inspect, override, or revoke what the agent does in their name.

This is a structural commitment, not a technology choice. Many agent operations conflate the agent with the user — the agent’s actions are logged as the user’s actions; the agent’s authority is the user’s authority; the agent’s failures look like the user’s failures. This is the floor violation that creates the most downstream problems.

The fix is conceptual first, then technical: the agent has its own name. Every action surfaces the agent did this on the user’s behalf, with the user’s mandate, attestable separately.

2. Scrutinise harder when it matters. The level of attention to an agent’s action scales with the consequence of the action. Low-stakes actions can run with light verification. High-stakes actions need substantially more — including possibly human-in-the-loop review.

This is not a piece of infrastructure. It is a discipline about how attention is allocated. A team that gives every action the same level of attention is either over-investing on the low-stakes (wasting resources) or under-investing on the high-stakes (carrying floor violations).

The discipline is to make consequentiality explicit — annotated, observable, used by the policy pipeline. Where consequentiality is high, the verdict pipeline runs more rigorously. Where it is low, the verdict pipeline runs lighter. The same agent, two different actions, two different rigor profiles.

3. The stop button stays with the human. No matter how autonomous the agent, no matter how confident the verdict pipeline, no matter how much value the agent is producing, the human retains the right to stop. The architecture must support immediate, observable, attestable revocation — of mandates, of credentials, of actions in flight.

This is also a discipline first, technology second. The discipline says: we will never deploy an agent that cannot be stopped. The technology that follows is the revocation infrastructure that makes the discipline executable. Most teams have parts of this already (kill switches, mandate revocation, credential rotation). The Phase 0 commitment is to use them as part of every agent’s operation — not just as breakglass tools.

Why These Three Are the Floor

The three disciplines are the floor because each addresses a structural failure mode that recurs across every phase of the maturity model:

• Agent-vs-user conflation breaks attribution at every phase. Without distinct identity, you cannot do per-action verdicts (Phase 1+), capability-proportional rigor (Phase 2+), forensic-ledger replay (Phase 3+), or floor-extension events (Phase 4+). The conflation pollutes everything above it.

• Uniform attention to all actions breaks rigor allocation at every phase. Without consequentiality awareness, you either over-invest on low-stakes (Phase 1 cost issue) or under-invest on high-stakes (Phase 4 capability-floor violation). The discipline has to be in place before the higher phases compose.

• Absence of the stop button breaks user trust at every phase. An agent that cannot be stopped is an agent whose authority cannot be bounded — and the entire authority architecture (Phase 1+) presumes bounded authority. Without revocation as a baseline, the framework’s authority claims are not actually enforceable.

If any of the three is missing, the higher phases don’t actually compose. The infrastructure can still be built, but the operation has gaps that the infrastructure cannot fill — because the gaps are below the infrastructure.

Phase 0 vs Phase 1

A useful distinction: Phase 0 is discipline, Phase 1 is infrastructure.

Phase 1 controls — workload identity, mandate validation, output attestation, forensic ledger, bounded execution, capability-and-consequentiality awareness (the Six Essentials) — are infrastructure investments. They cost engineering. They require platforms. They take a sprint to build.

Phase 0 disciplines are not infrastructure. They cost attention. They require commitment. They take a culture-shift to internalise.

Both are necessary. Phase 0 without Phase 1 is good intentions without execution surface. Phase 1 without Phase 0 is execution surface that runs orthogonal to the operation’s actual structure.

The order matters. Phase 0 first, Phase 1 second. The disciplines establish what the infrastructure is for. The infrastructure makes the disciplines executable at scale. Reversed, the team builds infrastructure that gets misused by an operation that hasn’t internalised the disciplines.

What “Phase 0 Floor” Means for the CISO

For the CISO, Phase 0 is the question to ask before any infrastructure debate:

• Is every agent’s action attributable to the agent, not silently to the user?
• Does our attention to actions scale with consequence?
• Can the human stop an agent immediately, with attestation that they did?

These three questions screen whether the operation has the floor. If the answer is yes for all three, the team is ready to build Phase 1 infrastructure. If any answer is no, that gap is what the next sprint addresses — and Phase 1 work waits until the floor is in place.

Trying to build Phase 1 infrastructure on a Phase 0 floor that has gaps produces frustrating projects: the infrastructure is built correctly, but the operation doesn’t compose with it because the disciplines underneath it are not in place. Six months in, the team realises the issue and goes back to fix the floor. The Phase 1 work has to be partially redone.

A team that gets the floor in place first builds Phase 1 once, on a foundation that supports it. A team that skips the floor builds Phase 1 twice — once on top of nothing, again after they realise the floor was missing.

The Disposition

Phase 0 is the floor. The floor is universal. The floor does not require infrastructure investment. The floor does require discipline.

A team that ships the disciplines — agent-vs-user distinction, consequentiality-aware attention, the stop button as a first-class operation — has Phase 0 in place. They are ready to build Phase 1 infrastructure on top, with confidence that the foundation will support what they build.

A team that skips the disciplines, or treats them as “we’ll get to that later,” builds infrastructure that doesn’t compose with the operation. Six months in, they pay the cost.

For the CISO conversation: Phase 0 is what every organisation should be operating from, regardless of where they are in the agent journey. Pre-deployment? Phase 0. First production agent? Phase 0. Hundredth production agent? Still Phase 0, underneath the higher-phase work.

It is the floor. Not the ceiling. Not the entry tier. The threshold below which agent operations do not run.