Topic starter
02/02/2026 10:12 pm
TL;DR: Static MFA and SSO checks do not address the risk that emerges after access is granted, according to StrongDM’s analysis of continuous zero trust authorization. Real-time validation, contextual signals, and destination-enforced policy are now the practical controls that keep identity decisions aligned with session risk.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Never Done: The Importance of Continuous Zero Trust Authorization”.
Key questions
Q: What breaks when Zero Trust stops at authentication?
A: Zero Trust breaks when teams stop at authentication because proving identity does not automatically define what that identity may do.
Q: Why do post-login controls matter more than MFA alone in zero trust?
A: MFA confirms identity at a point in time, but it does not govern what happens if the device is compromised, the session is hijacked, or the user drifts into an out-of-policy action.
Q: How do security teams know whether continuous authorisation is actually working?
A: Teams know it is working when sensitive actions are blocked or stepped up based on context, not just login state.
Practitioner guidance
- Implement runtime reauthorization for active sessions Require sensitive operations to be re-evaluated after login using current context rather than relying on a one-time sign-in result.
- Bind policy to device and context signals Incorporate device posture, location, requester attributes, and resource tags into decisions for privileged or high-risk actions.
- Move enforcement to the destination Apply policy where the access request lands so that central approval does not become a blind pass-through for downstream actions.
Bottom line: The article argues that zero trust fails when access is treated as settled after sign-in, because risk often appears during the session rather than before it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:36 pm
Continuous authorization is the control that closes the post-login trust gap: zero trust fails when teams stop at the login event and treat identity as settled for the rest of the session. The article is pointing to a runtime governance problem, not an authentication problem. For identity programmes, the decisive shift is from proving access at entry to revalidating it at the point of action.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between continuous authorisation and static access controls?
A: Static controls make a decision once and assume trust remains stable. Continuous authorisation rechecks whether access still fits the current session context before permitting further action. That distinction matters because the threat is often not initial entry but the drift that happens after access is granted.
👉 Read our full editorial: Continuous zero trust authorization closes the post-login trust gap