# Zero Trust Architecture

> A convention of authenticating and authorizing every request on its own identity and context, whatever network it comes from.

Record: `architecture:zero-trust-architecture`
Kind: style
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: contextual
Scope: system, network, identity
Canonical: https://banes-lab.com/ontology#architecture-zero-trust-architecture

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Least Privilege](https://banes-lab.com/records/architecture/least-privilege.md) and before [Secure by Default](https://banes-lab.com/records/architecture/secure-by-default.md).

## Repair

- Refactored by: Add AuthN/AuthZ, Segment Network
- Detected by: internal endpoints without authz/authn
- Violated by: implicit trust based on network location
- Measured by: trustless control coverage
- Enforced by: [policy-as-code](https://banes-lab.com/records/architecture/policy-as-code.md), gateway rules

## Requires

- [Strong Identity](https://banes-lab.com/records/lexicon/strong-identity.md)
- [Continuous Authorization](https://banes-lab.com/records/lexicon/continuous-authorization.md)

## Reinforces

- [Least Privilege](https://banes-lab.com/records/architecture/least-privilege.md)

## Enables

- [Perimeterless Security](https://banes-lab.com/records/lexicon/perimeterless-security.md)

## Conflicts with

- [Trusted Internal Network Assumption](https://banes-lab.com/records/lexicon/trusted-internal-network-assumption.md)

## In tension with

- [Latency/Complexity](https://banes-lab.com/records/lexicon/latency-complexity.md)

## Tensions

- [Zero Trust Architecture / Latency/Complexity](https://banes-lab.com/records/tension/latency-complexity-zero-trust-architecture.md)

## Severity

- [contextual](https://banes-lab.com/records/vocabulary/severity-contextual.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)