Zero trust
Zero trust is a security approach that grants access to resources through explicit policy decisions rather than assuming that a user or device is trustworthy because of its network location or ownership.
Being inside the network is not enough
A request still needs an access decision when it comes from an office network or a company-owned laptop. NIST SP 800-207 describes policies that consider identity, the requested resource, device state, and other relevant context, with access limited to what the task requires.
That does not mean people must type a password for every action. NIST describes access on a per-session basis and ongoing evaluation according to policy. Authentication can remain useful across permitted activity; it should not become an automatic right to every other resource.
Authentication and authorization explains the basic separation: establishing an identity and deciding what it may do are different jobs.
An architecture, not a product badge
NIST’s implementation guide demonstrates architectures assembled from multiple capabilities. A sign-in policy, a device check, or an identity product can contribute, but installing one does not establish that all resource access follows the intended rules.
Ask where the decision is enforced, what information it uses, and what happens when that information changes. Conditional Access is one specific policy mechanism; zero trust is the broader approach.
A practical review can start with a single resource: which identity should reach it, from what context, and with which permissions? The technical follow-on guide shows how an authorized request can test that boundary without claiming coverage of the whole environment.