Zero Trust · NIST SP 800-207 · OWASP least agency

Zero Trust for AI agents, enforced at the operating-system level.

Zero Trust is no longer a buzzword. It is codified guidance — NIST SP 800-207, the NSA's Zero-Trust Implementation Guides, OWASP's least agency — mandated for every US federal agency by 2027, and now being extended to autonomous AI agents. EuroOS was architected around these principles from the first line of kernel code, which lets us make a rare claim honestly: most of this framework is not something we bolt on — it is what the operating system already is.

Never trust, always verify Assume breach Least agency Capability-native

The design test: impossible, not tedious

The framework gives one test for any control — does this make the attack impossible, or just tedious? Controls whose value is friction (extra hops, rate limits, non-standard ports, SMS MFA) degrade against an adversary that can grind through tedious steps at machine speed. The controls that survive are "hardware-bound credentials, expiring tokens, cryptographic identity, and network paths that do not exist rather than paths that are merely inconvenient."

That is the definition of a capability model. In EuroOS, an agent that lacks a capability does not face a slower path to a resource — the path does not exist. The syscall returns EPERM before doing anything; the tool is not even listed for that agent; the file outside its sandbox cannot be named. EuroOS is, structurally, a system of removed capabilities, not throttled ones — and it is designed for breach: a successfully-injected agent can still only ever act within the capabilities it holds, with every action audited.

Control-by-control mapping

How the framework's six control families map onto EuroOS / EuroAgent. native built into the OS and verified · partial foundation present, product on the roadmap · out of scope a different approach, honest.

Agent identity & authentication native

Each agent ships as an Ed25519-signed .euroa bundle, verified before its manifest is even parsed. EuroIDM issues signed, expiring identity tokens; EuroCA is a sovereign local CA. The registry refuses to let a second publisher overwrite a trusted agent (anti-rug-pull).

Framework: cryptographic agent IDs (Foundation) → certificate-based auth (Enterprise).

Hardware-rooted trust partial

EuroTPM gives measured boot, a hardware RNG and PCR extend; EuroVault's master key and the full-disk-encryption key are TPM-sourced; EuroAttest produces signed PCR quotes for remote attestation. Full PCR-sealing of keys is the documented next mile.

Framework: hardware-bound credentials, attested issuance (Advanced).

Access control — least agency native

EuroGuard enforces deny-by-default at every syscall; capabilities can be dropped but never regained. EuroAgent's MCP gateway gates each tool by a required capability and lists only the tools an agent may call. EuroPol policy can only reduce the set — deny always wins.

Framework: RBAC deny-by-default (Foundation) → continuous, per-action authorization (Advanced).

Resource boundaries & isolation native

Agents run as capability-isolated WASM modules in EuroOS's own interpreter; the file backend confines each agent to /agents/<name>/. The boundary is identity and capability — services accept only the callers their policy names — exactly as the framework recommends, with network segmentation as a backstop, not the boundary.

Framework: identity-based isolation (Foundation) → sandboxed execution per agent (Enterprise).

Observability & immutable audit native

Every tool call is recorded with the agent's identity. Two complementary trails make it tamper-evident: a SHA-256 hash-chain (edit any past record and every later hash breaks) and a filesystem-enforced append-only log — clearing that flag itself requires a capability.

Framework: comprehensive logs (Foundation) → immutable, integrity-verified audit (Enterprise).

Supply chain & memory hygiene native

Tools are kernel-defined with fixed required capabilities, so poisoned tool metadata can't smuggle access. .eupkg packages are signed and verified; EuroRepro gives reproducible-build attestation with multi-builder consensus. Credentials live in a capability-gated vault, never cached in agent memory across sessions.

Framework: tool poisoning / rug-pull, confused-deputy, memory-based privilege retention.

Where EuroOS is unusually strong — and where it isn't

Native at the OS level

  • Several controls the framework calls Advanced (aspirational) are Foundation-level here, because they are properties of the OS, not add-ons.
  • Identity-based isolation — capability + identity at every boundary, not engineered on top of Kubernetes.
  • Hardware-rooted credentials & attestation — TPM measured boot, sealed vault, signed PCR quotes built in.
  • Immutable audit — a cryptographic hash-chain and filesystem-enforced append-only, not a logging add-on.
  • "Impossible, not tedious" — the capability model removes paths by construction; the framework's gold-standard control pattern is native.

Honestly partial or out of scope

  • Behavioural monitoring, anomaly detection, ML baselines and automated response — not implemented (EuroObserve gives metrics only).
  • Distributed tracing / OpenTelemetry across multi-agent flows; live SIEM streaming.
  • Hardware confidential-compute enclaves (SEV/TDX) — EuroOS uses a different model: the OS itself is the trusted base, so there is no large untrusted host to hide from.
  • mTLS-with-pinning as the agent transport; JIT privilege elevation with auto-revoke; full PCR-sealing of keys.
  • Prompt-injection input filtering is a model-layer concern — EuroOS's stance is to contain a compromised agent, not claim to perfectly prevent injection.
EuroOS is Zero Trust for AI agents, enforced at the operating-system level. Where the industry layers least-agency, identity-based isolation, hardware-bound credentials and immutable audit on top of Linux and Kubernetes, EuroOS makes them native kernel primitives — capabilities that remove the path rather than throttle it, on a sovereign, offline, EU-built OS designed for breach from the first line of code.
The EuroAgent platform Boot the preview Technical docs

Status labels reflect the EuroOS source tree (alpha, build 2026.06.08); each maps to a real subsystem in the technical reference. Framework sources: Anthropic, "Zero Trust for AI Agents"; NIST SP 800-207 Zero Trust Architecture; NSA Zero-Trust Implementation Guides; OWASP "least agency". EuroOS references the framework's principles for evaluation; it is not affiliated with or endorsed by these bodies.