Zero trust
No automatic trust for being inside the network: every request must prove who it is and be authorized for the exact resource it wants.
See it
What it is
Zero trust removes the automatic trust traditionally granted to an office network, VPN, device, or internal IP address. Access is decided for a specific identity, device, resource, and session using the evidence available now. NIST SP 800-207 describes the core idea: no implicit trust based only on network location or asset ownership. Google's BeyondCorp is the worked example, an internal rebuild that let staff work from any network without a corporate VPN.
Reach for it when a flat internal network lets one compromised laptop or service account roam across everything. Put authentication and authorization at each service boundary, issue short-lived credentials, scope access to the requested resource, segment workloads, and log the decision. OIDC can establish user identity, while mTLS and SPIFFE IDs can establish workload identity.
The gotcha is buying an access proxy and declaring the architecture finished. Zero trust is a policy model, not a product and not a demand to interrupt people with constant login prompts. A valid identity can still be overprivileged, a trusted device can still be infected, and a service can still skip tenant authorization. The decision must be narrow, repeatable, and enforced where the resource lives.
Ask AI for it
Refactor this system toward NIST SP 800-207 zero trust. Replace trust based on VPN presence, source IP, or an `X-Internal` header with OIDC user identity and short-lived, audience-bound access tokens. Enforce authentication plus resource-level and tenant-level authorization at every API boundary, give service workloads SPIFFE IDs over mTLS, and deny requests by default when identity or policy context is missing. Add network segmentation so services can reach only declared dependencies, log each allow or deny decision without token values, and add tests proving that an authenticated user, internal IP, or compromised service cannot cross a tenant or service boundary.