Zero trust assumes no implicit trust between users, devices, or services.

Conditional access and posture checks are table stakes.

Map policies to business risk.