Topic starter
07/06/2026 9:08 pm
TL;DR: Zero trust policy writing must move beyond simple identity checks to contextual decisions based on who, what, when, where, why, and how, with continuous session verification and just-in-time access shaping enforcement, according to StrongDM. That matters because access governance now has to account for context, device posture, timing, and activity, not static trust alone.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Unlocking Zero Trust: The Kipling Method for Policy Writing”.
Key questions
Q: What breaks when zero trust policy only checks who someone is?
A: Policy breaks at the authorisation layer because identity proof does not tell you whether access is appropriate for the current session, device or task.
Q: Why do contextual signals matter more for privileged access?
A: Privileged access increases blast radius, so time, location, device posture and activity all affect whether access is still acceptable.
Q: How do organisations know if zero trust controls are actually working?
A: They know the controls are working when they can inventory privileged identities, prove access is time-bound, and show that rotation and revocation happen on schedule.
Practitioner guidance
- Map policy decisions to the six Kipling questions Translate who, what, when, where, why and how into explicit access rules for your highest-risk systems so policy can be evaluated consistently.
- Add session-level re-evaluation to privileged access Require access to remain conditional after login, with termination when device trust, activity or location no longer matches policy.
- Use context to narrow production access Apply stronger constraints for regulated environments, including time windows, location controls and approved device posture.
Bottom line: Zero trust policy writing fails when access decisions stop at authentication and do not reflect session context, device posture or activity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 8:57 am
Contextual access control is the real operating system of zero trust. The article is correct that identity proof alone does not answer the policy question. Zero trust becomes meaningful only when access decisions incorporate session context, resource sensitivity and request purpose, not simply a successful login. For IAM and PAM teams, the practical conclusion is that policy logic must move closer to the moment of use.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between authentication and contextual authorisation?
A: Authentication confirms who the principal is. Contextual authorisation decides whether that principal should access a specific resource under the current conditions, including time, location, device trust and purpose. Zero trust depends on keeping those decisions separate, because a valid identity does not automatically justify ongoing access.
👉 Read our full editorial: Zero trust policy writing still depends on contextual access control
This post was modified 4 days ago by NHI Mgmt Group