What Is Zero Trust Architecture?

Quick answer
Zero trust is a security model that trusts nothing by default: every request is verified, regardless of where it comes from.
Its principles are verify explicitly, use least privilege, and assume breach.
It replaces the old “trusted inside the perimeter” model that modern cloud and remote work broke.

What is zero trust?

Zero trust is a security architecture built on the principle “never trust, always verify.” It assumes no user, device, or network is inherently trustworthy — whether inside the corporate network or out. Every request to access a resource must be authenticated, authorized, and validated before it’s granted. The name reflects the core shift: trust is no longer a location, it’s a decision made per request.

The three principles

Modern definitions converge on three rules. Verify explicitly: authenticate and authorize based on all available signals — identity, device health, location — not just a password. Use least privilege: grant only the access needed for the task, and only for as long as needed. Assume breach: design as if the network is already compromised — segment systems, encrypt, and monitor so a breach can’t spread freely.

Why it matters

The old model — a firewall protecting a “trusted” internal network — assumed everything inside was safe. Remote work, cloud, and stolen credentials broke that assumption: an attacker with one valid login was suddenly “inside” the trusted zone. Zero trust removes the inside/outside distinction and treats every access attempt as potentially hostile, which matches how modern systems actually work.

Where this bites vibecoders
Zero trust is a posture, not a product, and small teams benefit from its habits even without a formal program: don’t give services blanket network access, scope every key to one job, and assume any credential can be stolen. For AI agents and non-human identities, least privilege per request is exactly the discipline that contains a compromised agent.

Where AI coding assistants get this wrong

Generating open network rules (“allow all”) to make services connect faster.
Issuing broad, long-lived credentials instead of scoped, short-lived ones.
Treating “it’s on our network” as a security boundary.
Skipping per-request authorization in favor of a one-time login check.

Checklist

Authenticate and authorize every request, not just at login.
Apply least privilege to humans and machines alike.
Segment systems so a breach can’t move laterally.
Encrypt in transit and at rest, and monitor access.
Assume breach and rehearse containment, not just prevention.

FAQ

Is zero trust a product?

No. Vendors sell zero-trust components (identity, network access, policy engines), but zero trust is an architecture and set of principles. Buying a tool without changing how you grant access isn’t zero trust.

What is the difference between zero trust and MFA?

MFA is one control within zero trust — verifying identity with multiple factors. Zero trust is broader, covering authorization, least privilege, device posture, and segmentation. Phishing-resistant MFA is a recommended part of a zero-trust identity layer.

How does zero trust apply to service-to-service traffic?

The same way it applies to users: each service verifies the identity of the caller and grants the minimum access. A service mesh with mutual TLS and per-service policy is a common way to implement this for microservices.