The core idea
Zero Trust is an architectural approach, not a single product. Access decisions should consider identity, device posture, application, resource and relevant context rather than assuming that network location establishes trust.
Identity + Device + App + Context → Policy → Least-Privilege AccessIdentity first
Use strong identity signals and lifecycle controls. Privileged access should be narrow, attributable and observable.
Protect the device
Device posture can provide useful context for access decisions. Management and security controls should establish whether an endpoint meets the organization's defined requirements.
Authorize the application
Prefer access to the specific application or resource required rather than broad network reach. This reduces unnecessary lateral movement opportunities.
Verify continuously
Access is not a permanent trust grant. Re-evaluate relevant signals and monitor authentication, access and security events for meaningful changes.
Architecture rule
Make trust explicit, minimize access, and make every important decision observable.