Build a zero trust architecture
Protect named resources through explicit verification, least privilege, complete mediation, and assumed breach.
Topic index
Zero Trust
Learn the principles, trust boundaries, and request checks that define a zero trust architecture.
Topic index
Understand this domain
Pomerium coverage
Pomerium attaches identity-aware policy to named routes. It evaluates each protected HTTP request. It validates TCP and WebSocket policy when the connection starts. The upstream service still owns its resource and action permissions.
Limits
- Zero trust does not replace endpoint, application, data, or network security.
- A policy decision is only as reliable as its identity, context, and enforcement path.
- An established TCP or WebSocket connection does not end only because policy later changes.
Primary sources
1 learning path
Paths for this topic
13 related guides
Guides in this topic
Apply zero trust to cloud-native systems
Apply user and workload identity across APIs, gateways, meshes, sidecars, clusters, clouds, and application resources.
Combine segmentation with identity policy
Use network segmentation to limit reachability and identity policy to decide access to named services, resources, and actions.
Compare zero trust deployment models
Compare device agent and gateway, enclave gateway, resource portal, and application sandbox deployment boundaries.
Migrate one application to zero trust
Replace implicit network access with a named, identity-aware route and verify identity, policy, bypass, evidence, and recovery.
Place access control in a service mesh
Place identity, transport, route, and application policy across mesh gateways, sidecars, ambient proxies, and workloads.
Place the components of a policy system
Place policy administration, information, decision, enforcement, distribution, and evidence components in one access system.
Place zero trust policy components
Place policy administration, decision, information, and enforcement components across control and data planes.
Separate device identity from device posture
Distinguish the device, its key, ownership, management state, health evidence, policy, and freshness limits.
Separate zero trust from ZTNA
Distinguish a resource-centered security architecture from a product pattern that brokers selected remote access.
Threat-model a multi-cloud access path
Trace human and workload identity across clouds and find direct, federation, routing, control-plane, and recovery bypass paths.
Threat-model an identity-aware access path
Trace one protected request, find trust boundaries and bypass paths, and test which access decisions belong at the gateway and application.
Trace an identity-aware application request
Trace DNS, TLS, authentication, session, route, policy, upstream, application authorization, response, and evidence.
Use network controls in zero trust
Keep routing, segmentation, firewalls, naming, transport protection, and availability controls without using location as trust.
19 related terms
Concepts in this topic
Agentic Access Management (AAM)
Agentic Access Management controls agent actions with originating identity, explicit delegation, per-request policy, enforcement, and audit evidence.
Assume Breach
Design as if one identity, credential, workload, route, or control will fail, then limit movement and impact.
Clientless Zero Trust Access
Distinguish browser or native-client access from broad network tunnels and state which protocols still require a local connector.
Continuous Verification
Continuous verification means that a system continues to evaluate authorization during a session instead of treating the initial login as permanent trust.
Control Plane and Data Plane
Separate the systems that define and distribute access policy from the request path that enforces it on live traffic.
Device Posture
Device posture is the current security state of a device.
Hidden Trust Boundary
A hidden trust boundary exists when one component accepts another component's identity, authority, data, or result without an explicit enforced rule.
Implicit Trust Zone
An implicit trust zone grants authority from location, membership, or prior access without a resource-specific decision.
Micro-segmentation
The primary security goal of micro-segmentation is to limit which workloads can communicate and reduce lateral movement after compromise.
Named Resource Access
Grant access to one named application or service without extending general reachability to its network or neighboring systems.
Per-Request Authorization
Per-request authorization evaluates each action against current identity, resource, policy, and request context immediately before enforcement.
Principle of Least Privilege
Limit authority by resource, action, context, and time, then remove access when the assigned function ends.
Revocation Latency
Measure how long a disabled identity, authenticator, session, claim, or permission can continue to authorize action.
Software Defined Perimeter (SDP)
A software-defined perimeter hides protected services from unauthorized requesters and establishes identity-controlled connectivity.
Stale Authorization Context
Find authorization decisions that outlive the identity, relationship, policy, resource state, or request they evaluated.
Trust Boundary and Data Flow
Map where data or authority crosses between components with different control, identity, or assurance assumptions.
Zero Trust
Zero trust does not assume that every user or device is malicious.
Zero Trust Network Access (ZTNA)
ZTNA is an access approach that applies zero trust principles to connections between subjects and specific private resources.
Zero Trust Trust Algorithm
A zero trust trust algorithm combines subject, resource, action, context, policy, and confidence into an access decision.
