Zero Trust

Zero Trust is a security approach that doesn't keep trusting someone just because they were verified once — it re-checks every single access attempt.

Think of an office building. The old way worked like this: you swipe your badge once at the front door, and after that you can walk freely anywhere inside. Zero Trust is like requiring you to swipe your badge again at the meeting room, the server room, and the file room doors too. Simply being inside the building already is not, by itself, a reason to be trusted.

Recently, this principle has started being applied not just to people but to AI programs as well. As AI increasingly reads code, opens files, and carries out tasks on its own, there's a growing need to re-verify each time whether that AI actually has permission to do the task at hand, and whose instructions it's actually acting on. It's essentially extending the same access-control approach used for people to AI as well.

Microsoft added a new 'AI' pillar to its existing Zero Trust checklist, which had centered on identity, devices, and data, and released controls meant to apply across the entire process of AI agents writing and deploying code. OpenAI also used the same logic — giving stronger permissions only to verified users — when it released a security-focused model. One common misunderstanding is that Zero Trust is not the name of a specific product or piece of software. It refers to a security design principle of 'verify anyone, anytime, every time,' and the tools and procedures companies use to implement it vary from company to company.