Zero Trust Architecture

The components

NIST's architecture comes down to three logical parts. The policy engine makes the actual access decision, weighing identity, device posture, threat intelligence, and policy together. The policy administrator carries that decision out, opening or tearing down the communication path. Policy enforcement points (PEPs) sit in front of every protected resource and let through only what the broker approved. Feeding all of this are the signal sources: identity providers, device management, SIEM, threat feeds, whatever keeps the decisions current instead of stale.

The reference flow

A subject, meaning a user plus their device, requests a resource. The request hits a PEP, which defers to the policy engine. The engine weighs signals and policy, returns a verdict, and the policy administrator establishes or terminates the communication path based on the policy decision, with access enforced through the appropriate policy enforcement points. Trust is never inherited just because a packet came from the right subnet, and the session can be re-evaluated or revoked the moment a signal changes. In practice, the architecture is designed so that protected resources are not directly reachable by unauthorized subjects, with access mediated through policy enforcement points. Access only ever flows through an approved, identity-bound session.

ZTA versus the Zero Trust model

Zero Trust is the philosophy. Zero Trust Architecture is the blueprint you actually build from. An organization adopts the model by deploying the architecture itself: an identity provider feeding a policy engine, enforcement points sitting in front of applications, desktops, and data, and telemetry closing the loop back to the decision engine. ZTNA products package this architecture for application access. Zero Trust RDP applies the exact same structure to Windows remote desktops, with the broker doing double duty as both policy administrator and enforcement point.

Deployment patterns

NIST lays out a few patterns: enhanced identity governance, where identity is the primary policy driver; micro-segmentation, network-enforced isolation per workload; and software-defined perimeters, broker-established overlay connections. Real deployments blend all three, and remote access is usually where the software-defined-perimeter pattern shows up first, because it kills off exposed listeners outright.