Diagrams

1. 1The user opens the application, which has no session, so it redirects the browser to the identity provider with an authorization request.
2. 2The identity provider authenticates the user, password, passkey or certificate, and challenges for a second factor if policy requires one.
3. 3Policy is evaluated against signals: user risk, group membership, device compliance and registration state, network location, and the application being requested.
4. 4If the conditions are satisfied, the identity provider issues an authorization code back to the application's registered redirect URI.
5. 5The application exchanges the code, plus its client secret or certificate, for an ID token and an access token at the token endpoint.
6. 6The application validates the ID token signature, issuer, audience and expiry, then establishes its own session for the user.
7. 7The access token is presented to APIs, which validate it and authorise the request against the scopes and roles it carries.

Every step is a control point. Weak second factors, an unvalidated audience claim, an over permissive redirect URI, or excessive token lifetime each turn this flow into an attack path.

1. 1A request arrives for a specific resource, an application, an API, a file, an administrative interface.
2. 2The policy enforcement point intercepts it; nothing is trusted because of its network location.
3. 3The policy decision point gathers signals: verified identity, device posture and compliance, session risk, resource sensitivity, and requested action.
4. 4Policy is evaluated for this session only, granting the least privilege necessary for the requested action.
5. 5Access is allowed, allowed with additional controls such as step up authentication or a session limit, or denied.
6. 6The session is monitored continuously, and re evaluated when signals change; posture loss revokes access.

Zero Trust is this decision loop applied consistently across identity, devices, applications, network, infrastructure and data, not a product.

1. 1Preparation, playbooks written, roles assigned, telemetry retained long enough to investigate, and contacts confirmed.
2. 2Detection and analysis, an alert or report is triaged, scoped, and confirmed as a genuine incident with a severity assigned.
3. 3Containment, spread is stopped: hosts isolated, sessions and tokens revoked, credentials reset, attacker persistence removed.
4. 4Eradication, the root cause is removed, not just the symptom: the exploited weakness, the malicious access, the compromised account.
5. 5Recovery, systems are restored from known good state, monitored closely, and returned to service in dependency order.
6. 6Post incident activity, timeline documented, lessons converted into changes with owners, detections improved.

Preparation is the only phase you can complete before an incident, and it determines how the other five go.