Zero Trust Architecture Diagram

flowchart LR
  u1(["Employee<br/><i>managed laptop</i>"])
  u2(["Contractor<br/><i>unmanaged device</i>"])
  u3["Workload<br/><i>service identity</i>"]

  subgraph pep["Policy Enforcement"]
    direction TB
    px["Proxy / Gateway<br/><i>terminates every session</i>"]
  end

  subgraph pdp["Policy Decision"]
    direction TB
    eng{"Policy engine"}
    sig1["Identity + MFA"]
    sig2["Device posture"]
    sig3["Risk + location"]
    sig4["Resource sensitivity"]
    sig1 --> eng
    sig2 --> eng
    sig3 --> eng
    sig4 --> eng
  end

  subgraph res["Resources"]
    direction TB
    r1["Internal app"]
    r2[("Database")]
    r3["SaaS"]
  end

  u1 --> px
  u2 --> px
  u3 --> px
  px <-->|"authorise this request"| eng
  px -->|"allow · scoped · time-bound"| r1
  px -->|"allow · read-only"| r2
  px -->|"deny · posture fail"| r3
  log[("Decision log<br/><i>every allow and deny</i>")]
  eng --> log

What it is

The access model where network location grants nothing. Every request — human or workload, inside or outside — terminates at an enforcement point that asks a policy engine, and the engine decides from identity, device posture, context and the sensitivity of what is being reached.

The diagram's job is to show that no arrow bypasses the enforcement point. If one does, that path is the architecture and the rest is decoration.

When you produce it

During a security uplift, at the start of a landing zone design, and after a merger when two networks would otherwise be flat-joined by a VPN — which is the single most common way an acquisition spreads an incident.

Who reads it

Security architects and the identity team. Network engineers, who are usually being asked to stop treating the perimeter as the control. Auditors, who want to see the decision log.

What good looks like

• Workload-to-workload traffic goes through the model too, not just human access.
• The signals feeding the decision are named, including device posture — without it this is just SSO.
• Grants are scoped and time-bound; standing broad access is drawn if it exists, because pretending otherwise makes the diagram useless.
• Every decision, allow and deny, is logged, and the log is drawn.
• Legacy systems that cannot participate are shown with their compensating control, rather than omitted.

Common mistakes

• A VPN relabelled. If getting on the network still grants broad reach, nothing has changed.
• Humans only. Service identities are the majority of requests.
• No device signal, which reduces the decision to credentials, and credentials get phished.
• Hiding the exceptions. The mainframe that cannot do this is exactly what a reviewer needs to see.