Policy enforcement in Zero Trust is assessed:

A foundational tenet of Zero Trust is "never trust, always verify." This principle dictates that trust is never granted implicitly based on factors like network location or a previous successful authentication. Instead, policy enforcement is a continuous process that must be performed for every single access request from any user or entity to any resource. Each request is independently inspected, authenticated, and authorized against the current policy and context before a connection is permitted, ensuring a consistent and granular security posture.

A. For all traffic from the initiating source.

Policy is applied on a more granular per-request, per-destination basis, not as a blanket rule for a source.

B. Only if the risk score is high.

Policy is assessed for every request. The risk score is merely one of many contextual inputs used in the policy decision-making process.

C. For authorized users only.

Policy is assessed for all requesters to determine if they are authorized for that specific request; authorization is the outcome, not the prerequisite.

1. Rose, S., et al. (2020). NIST Special Publication 800-207: Zero Trust Architecture. National Institute of Standards and Technology. p. 7, Section 3.2. "Access to resources is determined by dynamic policy... Access is granted on a per-session basis."

2. Zscaler. (n.d.). The 7 Elements of a True Zero Trust Platform. Zscaler White Papers. "A true zero trust platform... must assess every connection request against your organization’s risk-based access policies before granting access."