Topic starter
27/08/2026 8:35 am
TL;DR: Zero Trust depends on continuous identity verification, granular least privilege, and context-aware access decisions, but Unixi argues that legacy IAM, SaaS sprawl, and weak visibility still make that hard to operationalise. The practical issue is not the principle itself but whether identity controls can keep pace across cloud, SaaS, and device context.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “The Role of IAM in a Zero-Trust World”.
Key questions
Q: What breaks when zero trust IAM is implemented as a one-time login control?
A: Standing access and durable privilege break the model, because zero trust depends on re-evaluating trust at the point of use.
Q: Why do SaaS environments make zero trust harder to govern?
A: SaaS environments spread access across many applications, data stores, and control planes, which makes it difficult to see who has what access and whether that access is still justified.
Q: How should security teams combine RBAC and ABAC in a Zero Trust programme?
A: Use RBAC for broad, routine access and ABAC for sensitive decisions where context changes the risk.
Practitioner guidance
- Map zero-trust decision points Identify where authentication, authorisation, and device validation are actually happening across cloud and SaaS applications, then mark the places where IAM does not control the decision path.
- Reduce privilege drift in role design Review RBAC structures for over-broad roles and stale permissions, then narrow access so each role reflects a current task set rather than historical accumulation.
- Add contextual policy signals Use ABAC attributes such as device state, location, and time of day where zero trust decisions need more precision than role membership can provide.
Bottom line: Zero trust depends on identity controls that can evaluate requests continuously across human, device, and application identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/08/2026 8:35 am
Identity-first zero trust is only as strong as the IAM control plane behind it. The framework’s promise depends on continuous verification, least privilege, and contextual authorisation being enforceable across every request path. When IAM is fragmented across cloud and SaaS, zero trust degrades into policy intent without operational reach. Practitioners should treat identity enforcement coverage as the real zero-trust maturity test.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What are the signs that a Zero Trust programme is not being enforced consistently?
A: A Zero Trust programme is likely failing when access still depends on trust by location, broad entitlements, or one-time authentication. Other warning signs are unmanaged exceptions, inconsistent policy enforcement across applications and networks, and access that is not clearly tied to identity and context. If teams cannot explain why a request was allowed, the control model is too loose.
👉 Read our full editorial: Zero trust depends on identity-first IAM, but implementation lags