15 Security, zero trust, and authorization

Zero trust is presented as a response to the collapse of the old network perimeter model. Instead of assuming that anything inside the corporate network is trustworthy, the chapter argues that modern environments with cloud services, mobile work, SaaS, and external collaborators require every access request to be evaluated in context. That means security must shift away from boundaries and toward continuous authorization, supported by strong authentication, trustworthy identity and device signals, and governance that keeps those signals current and reliable.

The chapter shows how policy-based access control provides the practical foundation for this shift. A policy engine evaluates each request using identity, device posture, operational signals, and environmental context, while the policy enforcement point applies the result at the resource. To make this scalable, ACME organizes policies into three layers: foundational security policies that define enterprise-wide non-negotiables, shared operational policies that capture cross-team rules like deployment windows or reporting access, and application policies that express service-specific logic. Because the evaluation model gives forbid rules priority, the architecture fails closed when required conditions are missing or unmet.

Beyond improving security, this layered policy model also improves how the organization works. It reduces duplicated logic, lowers reliance on VPNs and other perimeter assumptions, makes access decisions more consistent, and gives teams clearer ownership of their rules. The chapter closes by emphasizing that progress toward zero trust should be measured through architectural indicators such as policy coverage, signal quality, decision consistency, reduced perimeter dependence, and fewer exceptions. In this view, zero trust is not a product or a slogan, but an operational model built around governable authorization decisions.

Why the perimeter model fails in modern environments. In the traditional model (left), a firewall defined a clear boundary, and anything inside the perimeter was implicitly trusted. In modern environments (right), cloud services, mobile work, SaaS applications, and external collaborators eliminate meaningful boundaries.

Zero trust is enforced through continuous authorization. Every access request is evaluated by a policy engine. Identity attributes, device posture, operational signals, and environmental context further influence the decision. The result is enforced locally by the PEP guarding the target resource.

Zero-trust authorization is based on layered policies. Foundational security policies define enterprise-wide requirements. Shared operational policies capture rules owned by functional groups and applied across multiple systems or workflows. Application policies define service-specific authorization logic. These layers differ in scope and ownership but are evaluated together to produce a unified authorization decision.

Access control in a zero-trust security architecture. The PEP collects authentication context, device posture, and other request information to create a normalized request for the policy engine. The policy engine forms an effective policy set by selecting relevant foundational, shared operational, and application policies, and then evaluates the normalized request once to make a unified authorization decision. The PEP then enforces that decision at the target resource.

Independent dimensions of progress toward zero trust. Instead of following a maturity ladder, ACME evaluated its zero trust progress across several architectural dimensions: policy coverage, signal quality, decision consistency, reduced reliance on perimeter-based trust, and fewer authorization exceptions.

• Zero trust reframes enterprise security by emphasizing authorization over network boundaries.
• The lack of a meaningful perimeter makes location an unreliable trust indicator.
• Continuous, contextual evaluation of every access request is essential for a zero-trust security framework.
• Policy-based access control provides the decision layer necessary to enforce zero trust consistently.
• Authorization improves when identity, device posture, and contextual signals are accurate, up-to-date, and properly managed.
• Foundational policies specify enterprise-wide requirements such as authentication strength and device security.
• Shared operational policies modify access decisions based on operational or environmental factors.
• Application policies define rules and business logic for specific resources within each system.
• A policy engine can combine policies from different policy stores and evaluate them together in one decision.
• Forbid-overrides-permit semantics ensure consistent enforcement of foundational requirements across systems.
• Consistent authorization improves both security and productivity by ensuring reliable access.
• Clear policy ownership and separation of concerns reduce friction among security, operations, and product teams.
• Zero trust improves governance by clearly defining organizational intent through actionable policies.
• Progress toward zero trust is assessed across various dimensions, not via a linear maturity model.

FAQ