Topic starter
11/06/2026 11:17 pm
TL;DR: Zero trust has moved from theory to execution as identity standards such as OpenID Connect and SPIFFE mature, while centralized authorization replaces hard-coded application logic and narrows blast radius, according to Cerbos. The strategic shift is that access decisions now need auditable, request-level control as infrastructure becomes more distributed and AI agents add new non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Zero trust has reached operational reality”.
Key questions
Q: How should security teams implement continuous authorization in zero trust environments?
A: Start by defining which actions require revalidation after login, then attach runtime signals such as device health, location, and resource sensitivity to policy decisions.
Q: Why do distributed applications make authorization harder to govern?
A: Distributed applications create more places for authorization logic to drift.
Q: What breaks when authorisation is hardcoded into application logic?
A: Hardcoded access rules become brittle as systems grow, because each code path must be updated and retested whenever permissions change.
Practitioner guidance
- Centralize authorization decisions Move entitlement logic out of application code and into a dedicated policy decision service so permissions can be reviewed, versioned, and audited consistently across services.
- Map request-level policy boundaries Define the exact actions each identity type may perform and test whether a stolen service credential can still reach unrelated data or functions.
- Pair identity standards with policy governance Use OpenID Connect for user federation and SPIFFE for workload identity, then verify that a separate authorization layer decides what each identity can do.
Bottom line: Zero trust fails in practice when organisations stop at identity proofing and leave authorization hidden inside applications.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 7:54 am
Centralized authorization is the control plane zero trust was missing. Authentication and workload identity establish who is asking, but they do not govern what the identity is allowed to do. When authorization is buried in application code, every team becomes a policy engine, and the result is un-auditable permission drift. The practitioner conclusion is simple: zero trust fails operationally when entitlement is not centrally governed.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
A: Security teams should treat both people and AI agents as identities that must be authenticated, authorized, and continuously monitored. Apply least privilege to reduce blast radius, separate high-risk tasks from broad access, and review permissions as models and workflows change. This matters because compromised credentials, prompt manipulation, or overbroad access can turn an AI tool into a fast-moving insider risk.
👉 Read our full editorial: Zero trust now depends on centralized authorization and identity
This post was modified 5 days ago by NHI Mgmt Group