ZTA models in terms of access decisions are based on the principle of "never trust, always verify", which means that each access request is handled just-in-time by the policy decision points. The policy decision points are the components in a ZTA that evaluate the policies and the contextual data collected from various sources, such as the user identity, the device posture, the network location, the resource attributes, and the environmental factors, and then generate an access decision. The access decision is communicated to the policy enforcement points, which enforce the decision on the resource. This way, ZTA models apply a consistent access model throughout the environment for all assets, regardless of their location, type, or ownership.
References =
* Certificate of Competence in Zero Trust (CCZT) prepkit, page 14, section 2.2.2
* What Is Zero Trust Architecture (ZTA)? - F5, section "Policy Engine"
* Zero trust security model - Wikipedia, section "What Is Zero Trust Architecture?"
* Zero Trust Maturity Model | CISA, section "Zero trust security model"