Skip to content
1Claw Academy
Curriculum/Security Foundations2 minBeginner · Lesson 18 of 19

Zero trust and least privilege

Assemble the previous lessons into an architecture that assumes compromise rather than hoping to prevent it.

The perimeter model assumed a trusted inside and a hostile outside. It fails because it grants broad implicit trust to anything that gets in, and something always gets in.

Zero trust replaces location-based trust with per-request verification. Three commitments define it:

  • Never trust, always verify: every request is authenticated and authorized on its own merits, regardless of origin.
  • Assume breach: design so that a compromised component yields as little as possible.
  • Least privilege: every principal gets the narrowest grant that lets it do its job, for the shortest time.

Least privilege has three dimensions, and it is easy to remember only the first:

  • Scope: which resources, expressed as narrowly as the system allows.
  • Permission: read versus write; most principals need far less write access than they are given.
  • Time: how long the grant lasts. A permanent grant is a standing invitation.
Tip

Blast radius is the question to keep asking. Not 'can this be compromised' (assume it can) but 'what exactly does the attacker get when it is'. If the honest answer is 'everything', the design is wrong regardless of how good the controls are.

Everything in this track composes into one shape. Identity is established with signed, short-lived, audience-bound tokens. Authorization is decided by a deny-by-default policy engine, separately from enforcement. Key material is non-exportable in hardware, optionally split so no single party holds it. Sensitive processing happens inside an attested enclave. Every decision is logged for attribution.

Watch out

That architecture was designed for services and humans. The next track examines what happens when the principal is a language model that can be talked into things, and which of these assumptions survive contact with that.

Check your understanding

3 questions
1

Why does the perimeter model fail?

2

Which dimension of least privilege is most often overlooked?

3

What does 'assume breach' change about how you design?