Zero Trust Authorization
Authorization model where every request is verified independently — no implicit trust based on network location. "Never trust, always verify" applied to access control decisions.
Zero trust authorization applies the "never trust, always verify" principle to access control. Every request is verified on its own merits — regardless of origin, network location, or previous successful requests. No implicit trust: not because a user is inside the corporate network, not because their session looks valid — every sensitive operation requires a fresh, context-aware authorization check.
Beyond network segmentation
Zero trust is often reduced to network controls (mTLS, micro-segmentation). But if a request reaches your application logic, the network already trusted it. The layer that actually decides "should this identity do this thing right now?" is authorization — making authorization the enforcement heart of zero trust.
Key principles
- Per-request verification: check authorization on every sensitive operation
- Context signals: weigh device posture, MFA status, time, and risk score
- Least privilege: minimize blast radius of any single compromised identity
- Audit everything: log every decision for investigation and compliance
Related terms
Architecture pattern where authorization logic is moved from application code to a dedicated service (PDP). Your app asks for decisions rather than embedding permission checks.
Security principle that every subject should have the minimum access needed to perform its function — and no more. Foundation of zero trust and defense-in-depth architectures.
Immutable, chronological record of every authorization decision — who, what, when, scope, resource, action, and outcome. Enables compliance reporting and incident investigation.