Zero Trust Framework Proposed to Secure Autonomous Police and Rescue Drones

Public-safety drones are no longer just cameras in the sky. According to a systematic review published in Discover Robotics, autonomous unmanned aerial vehicles are shifting from scripted remote control toward agentic behavior: perceiving their environment, planning multi-step missions, retaining context, invoking external tools such as GIS and computer-aided dispatch systems, coordinating with other agents, and recommending actions to human operators. The review, led by Swarnamouli Majumdar and Anjali Awasthi, synthesizes literature from 2014 to 2026 spanning agentic UAV autonomy, Zero Trust Architecture, UAV cybersecurity, LLM-agent security, and public-safety robot governance, and distills it into a proposed six-layer governance model called the Zero Trust Agentic Drone Public-Safety framework, or ZTADP.

The operational backdrop is expanding quickly. The review cites the Law Enforcement Drone Association’s report of roughly 6,000 police drone programs in the United States by early 2026, a fourfold increase since late 2024, driven largely by drone-as-first-responder models in which a UAV launches automatically after a 911 call and often arrives before a human responder. Agencies in Fairfax County, Orlando, Victorville, and O’Fallon have reported drones reaching incidents in under a minute, clearing a majority of low-priority calls without dispatching an officer, and streaming live video to dispatchers before anyone is physically present. Reported figures include sub-60-second scene arrival times, call-clearance rates of roughly 64 percent without officer dispatch in some jurisdictions, and reductions of 15 to 20 percent in unnecessary patrol dispatches.

The authors argue that this autonomy multiplies the attack surface across identity, device, communication, data, AI-reasoning, and governance planes. A robot that merely transmits video can be secured through communication, access-control, and evidence-management safeguards. A robot that reasons over goals, selects tools, updates mission plans, and recommends operational action creates a new class of risk: the reasoning process itself becomes part of the public-safety infrastructure. If that reasoning is manipulated, biased, poorly explained, or legally misaligned, the harm may appear not as a software error but as an official public-safety decision.

The threat landscape the review consolidates spans cyber-physical attacks such as GPS spoofing, command hijacking, firmware and supply-chain compromise, jamming, and manipulation of 5G/V2X command-and-control links, alongside AI-model threats including adversarial sensor perturbation, model evasion, data poisoning, and confidence manipulation. Distinctively agentic threats include prompt injection, tool-stream injection, unauthorized tool calls, malicious tool chaining, model-router exploitation, and memory poisoning. The authors note that prompt-injection and tool-misuse research is mature for general LLM agents but remains underdeveloped in the UAV-security literature, a gap they identify as the central technical motivation for the framework.

ZTADP extends continuous verification, drawing on NIST SP 800-207 and CISA’s Zero Trust Maturity Model, to six layers: Mission, Identity and Access, Device, Communication, Agentic Reasoning, and Evidence and Governance. Its design principles include mission-scoped authorization binding every robot action to a specific incident, purpose, geography, time window, and legal basis; least-privilege autonomy; human confirmation for consequential actions; explainability by design; and tamper-evident audit logging. The defining departure from prior UAV Zero Trust work, which concentrated on identity, devices, and networks largely in military contexts, is the Agentic Reasoning layer: the AI’s planned tool calls are validated against a least-privilege allow-list, tool outputs are treated as untrusted data that cannot silently alter the mission goal, and consequential actions route through human confirmation with the AI’s rationale logged for audit.

The review itself followed PRISMA 2020 reporting principles. A structured search of IEEE Xplore, Scopus, and Web of Science, plus supplementary citation searching, identified 112 records; after duplicate removal and screening, 55 full texts were assessed and nine excluded, leaving 46 sources in the synthesis. Both authors independently screened a 25-record calibration subset, resolving disagreements by discussion, with Cohen’s kappa of 0.82 indicating strong agreement. Each retained source was coded against five dimensions: public-safety use case, agentic capability, threat type, Zero Trust control family, and governance concern, allowing cross-domain synthesis rather than domain-by-domain summary.

To ground the framework empirically, the authors ran a feasibility analysis using a calibrated synthetic annotation corpus modeled on the structural properties of the VisDrone2019 open-source UAV benchmark, matching its 548-frame validation split size, ten object categories, and occlusion and truncation taxonomies. They defined a Perception Trust Risk Score weighting small-object risk, occlusion, truncation, frame density, and public-safety criticality, flagging objects scoring 0.65 or higher for human-in-the-loop confirmation. Across 16,629 annotated synthetic objects, the pipeline found a 90.0 percent small-object rate, 55.9 percent occlusion, and an overall escalation rate of 33.9 percent, meaning roughly one in three perceived objects would require human confirmation. The highest-risk classes were people, pedestrian, and bicycle, and stressor analysis showed occlusion and small-object exposure, not class identity, drove most of the risk signal.

The authors are explicit about the limits of this demonstration. Because the corpus is calibrated synthetic data rather than the released VisDrone imagery, the results should be read as a methodological feasibility demonstration of the scoring and escalation pipeline, not a measured characterization of real drone imagery or an independently reproduced evaluation. The synthetic corpus does not reproduce real sensor noise, weather, camera motion, adversarial behavior, or incident prevalence, and the score values validate calculation and control-routing logic only. External validity, they write, requires preregistered evaluation on authentic annotations and ultimately timestamped public-safety UAV incident logs.

The paper also proposes a staged validation roadmap: scenario-based testing on representative missions such as missing-person searches and traffic accident assessment; simulation combining UAV simulators with SUMO and CARLA-style traffic environments; control-effectiveness testing against GPS spoofing, jamming, prompt injection, and malicious tool-output scenarios; and governance validation of whether each mission produces sufficient records for post-incident audit. Technical metrics would include prompt-injection success rate and unauthorized tool-call prevention, while governance metrics would cover audit-log completeness, the share of consequential actions with human confirmation, and evidence-chain completeness.

Nine research gaps emerge from the synthesis, including the absence of public datasets of public-safety UAV missions, the concentration of Zero Trust UAV testbeds in military settings, near-absent prompt-injection defenses adapted to UAV planners, weak explainability in autonomous UAV decisions, and no evidence-chain standard specific to UAV-sourced video, metadata, AI rationales, and tool-call logs. The authors also caution that ZTADP provides technical and procedural assurance only: a fleet may satisfy every technical check yet remain unacceptable if its purpose is disputed or its observation disproportionate, since the framework cannot confer democratic legitimacy or substitute for consultation, law, independent review, and redress. Cross-domain effectiveness in agriculture or infrastructure inspection, they note, remains untested future work.

Subject of Research: A systematic review and Zero Trust governance framework for agentic UAV robotics in public safety

Article Title: A systematic review and Zero Trust governance framework for agentic UAV robotics in public safety

Article References: Majumdar, S., & Awasthi, A. (2026). A systematic review and Zero Trust governance framework for agentic UAV robotics in public safety. Discover Robotics, 2(1), Article 26. https://doi.org/10.1007/s44430-026-00042-4

Image Credits: AI Generated

DOI: 10.1007/s44430-026-00042-4

Keywords: drones, public safety, Zero Trust Architecture, agentic AI, cybersecurity, drone-as-first-responder, UAV robotics, prompt injection, governance, explainability, human oversight, systematic