Enterprise Identity & Access Management Platform · View 24 of 27 · Assurance

Zero-Trust Zones & Enforcement Points

Where an attacker arrives, what stops them, and what an administrator still cannot reach.

Editable source SVG draw.io All views

Zones are trust levels, not network segments. Two workloads in the same subnet can sit in different zones, which is the whole point of identity-centric segmentation.
The privileged zone holds control-plane rights and no data-plane rights. An administrator who can restart a database cannot read it, and reading a secret is a separate, separately audited grant.
Every crossing carries either what authorises it or what stops it. An unlabelled boundary crossing in a security view is a gap in the design, not in the drawing.

Stolen password: smart lockout plus a required second factor. Password spray produces alerts rather than access.
Consent phishing: user consent is restricted and the admin consent workflow routes the request to a reviewer, so an OAuth lure yields a pending request.
Unmanaged device: Conditional Access requires compliance for anything beyond a restricted browser session, so credential theft alone is not enough.

Break-glass reaches the data zone by design. It is the only standing path across every boundary, and it is the most heavily alerted action in the tenant.
A compromised privileged workstation defeats the device signal. Mitigated by phishing-resistant authentication and short activation windows, not eliminated.
Token replay from a compromised endpoint remains possible within the token lifetime. Token protection and CAE narrow the window; they do not close it.