Parent folderOpen Confluence

RWS Architecture article

Zero Trust Network Access (ZTNA)

Zero Trust Network Access (ZTNA) is an identity-aware access approach that grants access to specific applications and services instead of broad network-level connectivity.

  1. Typefact
  2. Statusactive
  3. Domainsecurity
On this page
  1. Definition
  2. Scope in This Vault
  3. Architecture and Delivery Constraints
  4. Evidence Expectations
  5. Related

Definition

Zero Trust Network Access (ZTNA) is an identity-aware access approach that grants access to specific applications and services instead of broad network-level connectivity.

Scope in This Vault

ZTNA is a cross-domain security constraint used by architecture, ADR, and delivery notes.

It applies to:

  • user and operator access to platform services
  • service-to-service trust boundaries where identity and policy enforcement are required
  • emergency access flows that require explicit approval and auditability

Architecture and Delivery Constraints

  • Access decisions are identity-based and policy-evaluated; network location alone is not sufficient.
  • Default posture is deny-by-default with least-privilege role assignment.
  • Administrative entry points must integrate with centralized identity and single sign-on.
  • Exceptions (break-glass access) must be time-bound, approved, and logged.

Evidence Expectations

  • Authentication and authorization events are auditable and retained per policy.
  • Access policy changes are traceable through approved change workflows.
  • Periodic entitlement reviews are performed and documented.

Related