A Zero Trust policy enablement and subsequent application connection should always be permanent.

This statement is false. A foundational principle of Zero Trust is that trust is ephemeral and must be re-established for each new session or request. Connections are not permanent; they are dynamically created based on policy and context, and continuously verified. Granting permanent access would reintroduce the concept of implicit trust based on a one-time authentication event, which directly contradicts the "never trust, always verify" mantra of Zero Trust. This would create a significant security vulnerability, as the risk posture of a user or device can change at any moment.

The statement is fundamentally incorrect as Zero Trust architecture is built on the principle of ephemeral, per-session access, not permanent connections.

1. Zscaler. (2023). Zero Trust Certified Architect (ZTCA) Certification Study Guide. Module 1: Introduction to Zero Trust, Section: "The Principles of Zero Trust," p. 6. "The first principle is to terminate every connection... This prevents lateral threat movement." (Terminating connections is antithetical to permanent connections).

2. National Institute of Standards and Technology (NIST). (2020). SP 800-207: Zero Trust Architecture. Section 3.1.2: ZTA Policy Enforcement Point, p. 15. "The PEP should be able to terminate connections if a reauthentication or reauthorization is required."