Topic starter
13/10/2026 10:40 am
TL;DR: PlainID maps NIST SP 800-207 and SP 800-207A to runtime authorization, arguing that zero trust only becomes enforceable when every request is checked against live policy and context before access is granted. Static login-time entitlements leave human, service, workload, and AI agent identities over-privileged after authentication.
Editorial analysis by NHI Mgmt Group, based on content published by PlainID: “Operationalizing Zero Trust: How Runtime Authorization Fulfills NIST SP 800-207 & SP 800-207A”.
Key questions
Q: Why does zero trust fail if authorization stays at login time?
A: Because login-time checks only confirm identity at the front door.
Q: How should security teams roll out runtime authorization without disrupting services?
A: Start with shadow mode, measure policy impact on live traffic, and promote rules gradually from observation to enforcement.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Practitioner guidance
- Implement runtime authorization at the resource edge Place policy enforcement points at applications, gateways, data platforms, and service entry points so decisions happen where the protected action occurs, not only at login.
- Separate policy decision from enforcement Keep the policy engine central for governance and auditability, but let distributed enforcement apply the decision close to the asset to reduce blast radius.
- Scope workload and agent access by action Define authorisation around the specific API call, data request, or tool action a service or agent is allowed to perform under current context.
Bottom line: Zero trust only becomes enforceable when access is decided at runtime, against live policy and context, rather than assumed after authentication.
What's in the full article
PlainID's full article covers the operational detail this post intentionally leaves for the source:
- The full NIST SP 800-207 to runtime authorization mapping across Policy Engine, Policy Administrator, and Policy Enforcement Point
- The seven-step zero trust decision flow, including where identity attributes, risk scores, and resource metadata enter the decision
- Concrete enforcement scenarios for workforce access, service-to-service calls, and AI agent tool execution
- The article's architecture view of policy as code, auditability, and distributed enforcement across applications and gateways
👉 Read PlainID's analysis of runtime authorization for NIST zero trust →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 10:40 am
Runtime authorization is the control plane zero trust was missing. Authentication proves who or what is present, but it does not answer what that identity may do at the moment of use. NIST SP 800-207 makes that distinction explicit, and the article correctly pushes the decision into policy evaluation and local enforcement. For practitioners, the implication is that zero trust maturity should be measured by decision-time control, not by login success.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between network segmentation and identity-tier authorization?
A: Network segmentation controls where traffic can flow. Identity-tier authorization controls whether a specific identity may perform a specific action on a specific resource under current context. In modern distributed systems, segmentation may reduce reachability, but only identity-tier policy can reliably constrain application functions, data exposure, and delegated tool use.
👉 Read our full editorial: Runtime authorization makes zero trust enforceable for NHIs