AI security and zero trust

Your AI environment might be secure. Its integrations might not be.

Every AI integration introduces another trust boundary. Once AI connects to email, CRM, databases and business applications, it encounters different authentication methods, permissions and security policies.

Securing the AI environment alone does not secure what AI can do across those systems.

Holiday provides a trusted environment with independent authorisation and consistent security enforcement across connected systems managed through Holiday.

Explore Holiday Security Review Your AI Integration Security

The integration problem

There is no truly isolated AI environment once it connects to your business.

Enterprise AI needs company information, business applications and the ability to perform actions. Protecting the model or its hosting environment does not resolve every security question introduced by those connections.

The more useful AI becomes, the more systems it needs to access.

AI that cannot access business information is limited. AI that cannot act on business systems is limited further.

Integrations are not an edge case. They are the direction enterprise AI is moving. The question is no longer whether organisations will connect AI to their systems, but how they will maintain security when they do.

Different systems. Different permissions.

Microsoft 365 users, CRM administrators and database operators may have completely different rights. API scopes, service accounts and application permissions add further authority.

Authentication is not authorisation.

A valid token proves access under its granted authority. It does not establish whether a particular AI action is appropriate for the person requesting it or the AI identity performing it.

Permissions do not always travel with data.

Information exposed through an API may not carry every interface restriction from its source system. Access must be constrained at the point where Holiday retrieves or acts on it.

The question is not simply whether an integration is authenticated. It is whether every action and data disclosure remains authorised.

Zero trust architecture

Zero Trust must extend beyond the login.

An authenticated AI identity can request many actions during one session across multiple applications, data sources and security domains. Holiday evaluates the action rather than relying on the session alone.

Authority one What the AI identity is permitted to do

Authority two What the requesting person is permitted to do

Effective authority The action Holiday may allow

No AI identity receives extra authority simply because a person has authenticated or an integration credential exists. Holiday applies checks at its enforcement boundary before a managed action proceeds.

This reflects the resource and identity focused principles in NIST SP 800 207. It is an architectural alignment, not a claim of NIST certification or organisation wide Zero Trust compliance.

How Holiday works

One consistent security boundary across connected systems.

Holiday places an independent control layer between AI activity and the business systems it is authorised to access. Destination applications keep their own security controls. Holiday adds an AI specific decision across the integrations it manages.

Identity and policy are evaluated before controlled execution

User

AI identity

Holiday enforcement boundary Identity and policy decision User authority ∩ AI authority

Authorised tool or API execution Approved action and scoped connection

Connected business systems Email · CRM · Database · Documents

Rejected actions stop at the Holiday boundary.

01

Identity and authority

Identify the requesting user, the AI identity and the authority assigned to each.
02

Policy enforcement

Evaluate the proposed action against permissions, restrictions and approval requirements.
03

Integration controls

Apply the decision before execution through an approved API, database connection or business integration.
04

Granular data access

Limit resources and fields exposed through the configured integration where its enforcement design supports those controls.
05

Audit and accountability

Record the identity, action, target, authorisation decision and available result for governance and investigation.

OAuth, APIs and service accounts

A valid token does not make every AI action safe.

Integration credentials are essential, but their authority may be broader than the authority intended for one AI task. Holiday does not treat valid credentials as permission for every possible action.

A practical integration risk

An employee asks an AI assistant to update a customer record.

The assistant uses an integration token with access to thousands of records and permission to delete them. The API accepts the token. But who determines whether the AI should have been allowed to perform that particular action?

Authentication allowed the connection. It did not authorise the AI's decision.

Before execution, Holiday independently checks the requesting person's authority and the actions permitted for the AI identity. Only the authority shared by both may proceed.

Credentials provide access. Policy determines use.

Integration credential Broad API access Read · Create · Update · Delete

Holiday policy Independent authorisation

Permitted AI action Read approved customer records Other operations denied

An authenticated connection establishes a means of access. Holiday determines whether an AI action through that managed connection is permitted.

Credential storage, scope, rotation and protection remain essential. Holiday complements rather than replaces those controls.

Granular data security

Authorised access should not mean access to everything.

Holiday exposes registered business resources according to the requesting person’s Data Access and the AI identity’s assigned authority. Available granularity depends on the integration and how its access boundary is configured.

Permitted response

Customer service context

Customer name
Service history
Appointment status

Restricted information

Not supplied to the AI

Medical information
Financial account details
Personal identification numbers

The safest way to prevent restricted information from being exposed is to prevent it from reaching the AI in the first place.

Field and record controls require a connector and data design that can enforce them. Connector specific scope should be confirmed during solution design.

AI governance

Security policies should be enforced, not just documented.

Holiday helps translate organisational rules into technical restrictions across approved integrations, tools, resources and actions.

Govern what AI can access

Restrict available integrations, tools, resources and sensitive data.

Govern what AI can do

Define permitted actions and approval requirements for higher risk operations.

Govern delegated authority

Do not automatically give an AI identity every permission held by the requesting person.

Maintain accountability

Capture activity and authorisation decisions for oversight, review and investigation.

Explore Holiday Governance

People and digital employees

Your next security challenge may be AI operating as your employees.

Personal assistants, digital clones and autonomous agents introduce machine activity into systems designed around human users. A person having permission does not mean autonomous AI should inherit it.

Holiday separates human authority from AI authority inside its managed environment. A user may access a system while the AI acting for them remains restricted to explicitly permitted responsibilities.

Holiday cannot enforce controls over credentials, connections or AI services operating entirely outside its boundary. Australian organisations still need policies and technical controls for unapproved AI use.

See controlled Digital Employees

Architecture and security principles

A security architecture built around enforcement.

Independent AI authorisation: Separate human and AI authority evaluated before controlled tool execution.
Zero Trust principles: No implicit trust because a user, AI session or integration has authenticated.
API and integration boundaries: Policy enforcement over operations routed through Holiday managed connectors.
Data restrictions: Resource and field restrictions where the configured integration can enforce them.
Human oversight: Approval and escalation mechanisms for actions requiring human authorisation.
Traceable activity: Governance records that support reconstruction and review of AI operations.

Holiday does not replace identity providers, API security, endpoint protection, network security or the controls of connected applications. It provides an additional AI security boundary inside its managed environment.

Explore the Holiday Environment

Technical questions and answers

Questions security teams ask.

Is enterprise AI already secured by its provider?

Enterprise AI providers may secure their own platforms, but those controls do not automatically establish consistent authorisation across every external business system an AI connects to. Integration permissions, API credentials, delegated authority and data access policies still require careful management.

Why is OAuth not sufficient on its own?

OAuth provides a framework for delegated access, but its effectiveness depends on scopes, resource server enforcement and integration design. A token may grant broader permissions than a particular AI action requires. Holiday adds an independent authorisation decision for actions passing through its managed integrations.

What happens if the AI is affected by prompt injection?

Prompt injection may influence a model into proposing actions outside its intended task. An independently enforced tool boundary can reject operations that exceed configured permissions even when the model requests them. This limits the consequences of certain failures but does not eliminate every prompt injection or data exfiltration risk.

Can Holiday restrict individual database fields?

Holiday can expose only registered resources and fields through its managed data interfaces. Field specific isolation depends on the relevant connector, data model and enforcement design. The available controls must be confirmed for each integration and applied before protected data is supplied to AI.

Does Holiday replace Microsoft Entra ID or existing identity and access management?

No. Existing identity providers and application authentication remain essential. Holiday complements them by applying AI specific authorisation and policy enforcement across integrations managed by Holiday.

Does using Holiday make an organisation Zero Trust compliant?

No individual product makes an entire organisation compliant with Zero Trust principles. Holiday is designed to apply relevant Zero Trust security patterns within its own managed environment. Wider assurance depends on the organisation’s full architecture and operational practices.

Can Holiday govern AI activity across multiple applications?

Yes, for applications integrated through supported and configured Holiday control mechanisms. Holiday cannot enforce policy over connections, credentials or AI services that operate entirely outside its managed boundary.

External security guidance

Built around established security principles.

These technical publications inform the security discussion. They are not endorsements or certifications of Holiday.

NIST

Do not trust the AI. Trust the environment it operates in.

Holiday helps Australian organisations enforce AI permissions, restrict sensitive information and govern activity across connected business systems without weakening existing security controls.

Review Your AI Integration Security Explore the Holiday Environment