{
  "code": null,
  "collection": "architecture",
  "href": "https://banes-lab.com/ontology#architecture-zero-trust-architecture",
  "id": "zero-trust-architecture",
  "kind": "style",
  "layer": {
    "href": "https://banes-lab.com/ontology/schema#layer-security-core",
    "json": "https://banes-lab.com/json/records/layer/security-core",
    "label": "Security Core",
    "markdown": "https://banes-lab.com/records/layer/security-core.md",
    "ref": "layer:security-core"
  },
  "name": "Zero Trust Architecture",
  "ref": "architecture:zero-trust-architecture",
  "relations": [
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-strong-identity",
          "json": "https://banes-lab.com/json/records/lexicon/strong-identity",
          "label": "Strong Identity",
          "markdown": "https://banes-lab.com/records/lexicon/strong-identity.md",
          "ref": "lexicon:strong-identity"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-continuous-authorization",
          "json": "https://banes-lab.com/json/records/lexicon/continuous-authorization",
          "label": "Continuous Authorization",
          "markdown": "https://banes-lab.com/records/lexicon/continuous-authorization.md",
          "ref": "lexicon:continuous-authorization"
        }
      ],
      "relation": "requires"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-least-privilege",
          "json": "https://banes-lab.com/json/records/architecture/least-privilege",
          "label": "Least Privilege",
          "markdown": "https://banes-lab.com/records/architecture/least-privilege.md",
          "ref": "architecture:least-privilege"
        }
      ],
      "relation": "reinforces"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-perimeterless-security",
          "json": "https://banes-lab.com/json/records/lexicon/perimeterless-security",
          "label": "Perimeterless Security",
          "markdown": "https://banes-lab.com/records/lexicon/perimeterless-security.md",
          "ref": "lexicon:perimeterless-security"
        }
      ],
      "relation": "enables"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-trusted-internal-network-assumption",
          "json": "https://banes-lab.com/json/records/lexicon/trusted-internal-network-assumption",
          "label": "Trusted Internal Network Assumption",
          "markdown": "https://banes-lab.com/records/lexicon/trusted-internal-network-assumption.md",
          "ref": "lexicon:trusted-internal-network-assumption"
        }
      ],
      "relation": "conflicts-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-latency-complexity",
          "json": "https://banes-lab.com/json/records/lexicon/latency-complexity",
          "label": "Latency/Complexity",
          "markdown": "https://banes-lab.com/records/lexicon/latency-complexity.md",
          "ref": "lexicon:latency-complexity"
        }
      ],
      "relation": "tensions-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#tension-latency-complexity-zero-trust-architecture",
          "json": "https://banes-lab.com/json/records/tension/latency-complexity-zero-trust-architecture",
          "label": "Zero Trust Architecture / Latency/Complexity",
          "markdown": "https://banes-lab.com/records/tension/latency-complexity-zero-trust-architecture.md",
          "ref": "tension:latency-complexity-zero-trust-architecture"
        }
      ],
      "relation": "tensions"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-trusted-internal-network-assumption",
          "json": "https://banes-lab.com/json/records/lexicon/trusted-internal-network-assumption",
          "label": "Trusted Internal Network Assumption",
          "markdown": "https://banes-lab.com/records/lexicon/trusted-internal-network-assumption.md",
          "ref": "lexicon:trusted-internal-network-assumption"
        }
      ],
      "relation": "violated-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-authentication",
          "json": "https://banes-lab.com/json/records/architecture/authentication",
          "label": "Authentication",
          "markdown": "https://banes-lab.com/records/architecture/authentication.md",
          "ref": "architecture:authentication"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-authorization",
          "json": "https://banes-lab.com/json/records/architecture/authorization",
          "label": "Authorization",
          "markdown": "https://banes-lab.com/records/architecture/authorization.md",
          "ref": "architecture:authorization"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-network-segmentation",
          "json": "https://banes-lab.com/json/records/lexicon/network-segmentation",
          "label": "Network Segmentation",
          "markdown": "https://banes-lab.com/records/lexicon/network-segmentation.md",
          "ref": "lexicon:network-segmentation"
        }
      ],
      "relation": "refactored-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-zero-trust",
          "json": "https://banes-lab.com/json/records/lexicon/zero-trust",
          "label": "Zero Trust",
          "markdown": "https://banes-lab.com/records/lexicon/zero-trust.md",
          "ref": "lexicon:zero-trust"
        }
      ],
      "relation": "term"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#vocabulary-severity-contextual",
          "json": "https://banes-lab.com/json/records/vocabulary/severity-contextual",
          "label": "contextual",
          "markdown": "https://banes-lab.com/records/vocabulary/severity-contextual.md",
          "ref": "vocabulary:severity-contextual"
        }
      ],
      "relation": "severity"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/records/architecture-category/security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md",
          "ref": "architecture-category:security-privacy-compliance-governance"
        }
      ],
      "relation": "category"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md",
          "ref": "chapter:/ontology#architecture-category-security-privacy-compliance-governance"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-security-privacy-compliance",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-security-privacy-compliance",
          "label": "Security Privacy Compliance",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-security-privacy-compliance"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-vocabulary-severity",
          "json": "https://banes-lab.com/json/ontology/schema/the-vocabulary-severity",
          "label": "Severity levels",
          "markdown": "https://banes-lab.com/ontology/schema/the-vocabulary-severity.md",
          "ref": "chapter:/ontology/schema#the-vocabulary-severity"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-resolutions",
          "json": "https://banes-lab.com/json/ontology/schema/the-resolutions",
          "label": "The resolutions",
          "markdown": "https://banes-lab.com/ontology/schema/the-resolutions.md",
          "ref": "chapter:/ontology/schema#the-resolutions"
        }
      ],
      "relation": "linked-from"
    }
  ],
  "summary": "A convention of authenticating and authorizing every request on its own identity and context, whatever network it comes from.",
  "siblings": {
    "next": {
      "href": "https://banes-lab.com/ontology#architecture-secure-by-default",
      "json": "https://banes-lab.com/json/records/architecture/secure-by-default",
      "label": "Secure by Default",
      "markdown": "https://banes-lab.com/records/architecture/secure-by-default.md",
      "ref": "architecture:secure-by-default"
    },
    "previous": {
      "href": "https://banes-lab.com/ontology#architecture-least-privilege",
      "json": "https://banes-lab.com/json/records/architecture/least-privilege",
      "label": "Least Privilege",
      "markdown": "https://banes-lab.com/records/architecture/least-privilege.md",
      "ref": "architecture:least-privilege"
    }
  },
  "up": {
    "href": null,
    "json": "https://banes-lab.com/json/api/records/architecture",
    "label": "Architecture principles",
    "markdown": "https://banes-lab.com/api/records/architecture.md",
    "ref": "api:records/architecture"
  },
  "aliases": [
    "Zero Trust"
  ],
  "exemplar": {
    "after": "const identity = authenticate(request.credentials);\nauthorize(identity, \"foo:create\", { resource: request.body.id });\nverifyDevice(request.deviceAttestation);\nreturn createFoo(CreateFooSchema.parse(request.body));",
    "before": "if (request.network === \"internal\") return createFoo(request.body);",
    "lang": "ts",
    "medium": "code"
  },
  "formedBy": null,
  "scope": [
    "system",
    "network",
    "identity"
  ],
  "severity": "contextual"
}