An access architecture where policy enforcement, telemetry, and governance run inside the organisation's own infrastructure rather than a vendor-managed service. It matters because trust, auditability, and data locality stay under direct operational control, which is often required in regulated or sovereign environments.
Expanded Definition
Self-hosted zero trust is a deployment model for Zero Trust Architecture where the organisation operates policy decision points, policy enforcement points, telemetry pipelines, and governance controls inside its own environment instead of outsourcing them to a vendor-managed control plane. That distinction matters because the access model is only part of the design. Data locality, audit ownership, and change control are equally important in regulated, air-gapped, or sovereign environments.
In NHI security, the term usually applies to service accounts, API keys, workload identities, and machine-to-machine access flows that must be continuously evaluated rather than implicitly trusted. It aligns closely with the principles described in NIST SP 800-207 Zero Trust Architecture, but the implementation choice is operational, not purely conceptual. Definitions vary across vendors, especially when "self-hosted" is used to describe only a locally deployed proxy while policy logic still depends on external SaaS.
The most common misapplication is calling a partially localised access gateway "self-hosted zero trust" when the policy engine, identity telemetry, or revocation workflow still depends on a third-party service.
Examples and Use Cases
Implementing self-hosted zero trust rigorously often introduces infrastructure and governance overhead, requiring organisations to weigh tighter control and sovereignty against higher operational responsibility and maintenance cost.
- A financial services firm runs internal policy engines for machine identity access to payment APIs, keeping decision logs inside its own audit boundary.
- A defence contractor uses local enforcement for build agents and deployment pipelines because external policy dependencies would conflict with classified network requirements, a pattern often discussed alongside the Guide to SPIFFE and SPIRE.
- A healthcare provider hosts device and workload trust decisions on-premises so access telemetry stays within its regulated environment while still applying Zero Trust controls.
- An industrial operator segments OT-adjacent services with self-managed identity policy to avoid vendor connectivity in plants with limited or restricted internet access.
- A public sector agency uses internal control planes to enforce just-in-time access for service accounts, then reviews the design against Ultimate Guide to NHIs — Standards and NIST SP 800-207 Zero Trust Architecture.
Why It Matters in NHI Security
Self-hosted zero trust matters because NHI environments fail differently from human login systems. Service accounts, tokens, certificates, and API keys often operate at machine speed, which means weak visibility or delayed revocation can create broad and persistent exposure. NHI Mgmt Group notes that 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, and that statistic is especially relevant when the organisation also demands self-hosted enforcement and auditability.
The governance challenge is not just trust policy. It is proving that policy enforcement, logs, rotation, and offboarding remain under direct control when secrets, workloads, and integrations multiply across pipelines and third parties. This becomes more urgent when access has to be revoked instantly without depending on an external service boundary. In practice, self-hosted zero trust is often adopted after an audit finding, a sovereignty review, or a breach exposes how much machine access still depended on outside control planes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST Zero Trust (SP 800-207) and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | Defines Zero Trust principles this term implements inside owned infrastructure. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | Self-hosted controls help reduce secret sprawl and identity exposure across machine access paths. |
| NIST CSF 2.0 | PR.AC-5 | Supports least-privilege, network segmentation, and access control for non-human workloads. |
Place policy, telemetry, and enforcement under internal control while verifying every NHI request.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on June 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
