What it means
A network connection and permission to use an application are separate decisions. ZTNA places a policy enforcement point between a requester and a particular service. The decision can consider the person’s identity, device condition, application, and session context. An employee may reach the scheduling application without gaining a route to the surrounding server network. The application still needs its own permissions: reaching a patient system must not automatically allow viewing every patient or exporting its database. The identity service and access broker also become dependencies that need an outage plan.
AN ILLUSTRATIVE SCENARIO
A contractor needs one application
A water utility hires an engineer to review maintenance drawings. The engineer needs the document portal during a two-week engagement, but no access to pump controllers. The team publishes only that portal through its access broker, requires an approved identity and managed device, and gives the account read-only access inside the portal. An expiry ends the engagement. Operations staff test what happens when the broker is unavailable before relying on it for urgent maintenance work.
Put it to work
- List the specific application, user group, permitted tasks, device requirements, and access duration. Include service-to-service connections that must continue without a person signing in.
- Configure a narrow application policy, retain application-level authorization, and limit direct paths that could bypass the broker. Pilot with a small group and document emergency access.
- Record connection decisions and application activity. Assign owners for identity outages, revoked accounts, stale device information, and periodic policy review.
How to check your work
Using test accounts, confirm the approved contractor can read drawings, cannot change them, cannot reach unrelated services, and loses access at expiry. Check both broker logs and application decisions, including an attempted direct connection.
Connect the ideas
- Zero trust
An architecture approach that grants no implicit trust from network location or asset ownership and evaluates access to resources using identity, device, and other context.
- Authorization
The decision about whether a person, device, workload, or anonymous requester may perform a particular action on a resource.
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.