The deployment of agentic AI systems in cloud environments introduces a fundamental security challenge: autonomous agents require broad, dynamic access to cloud resources to perform their functions, yet must be constrained to prevent unauthorized actions, privilege escalation, and cross-agent compromise. Traditional perimeter-based and role-based access control (RBAC) models are insufficient for agentic workloads because agents operate with natural language intent interfaces, invoke tools dynamically, and may execute across multiple cloud accounts and regions in ways not anticipated at deployment time. This paper presents ZT-AgentCloud (Zero-Trust Architecture for AI Agent Cloud Orchestration), a comprehensive security architecture implementing zero-trust principles specifically adapted for agentic AI systems. ZT-AgentCloud defines five architectural pillars: (1) ephemeral per-task credential provisioning, (2) intent-aware policy enforcement, (3) cryptographic agent identity with workload identity federation, (4) behavioral anomaly detection for agent actions, and (5) immutable audit logging of agent reasoning and tool invocations. We present a reference architecture with concrete implementation guidance for AWS, Google Cloud Platform, and Microsoft Azure, validated through a prototype deployment evaluated against the NIST SP 800-207 zero-trust maturity model. Our results demonstrate that ZT-AgentCloud achieves optimal zero-trust maturity (Level 3) across all five pillars while maintaining agent operational efficiency with less than 8% latency overhead.