ZERO TRUST
Zero Trust,
Zero Trust decides who reaches a resource. Ironproof decides whether may run. Before each critical action executes, Ironproof allows it or blocks it against your formal policy, and every allowed action leaves sealed evidence anyone can verify offline, without trusting us.
01 · WHAT ZERO TRUST IS
No implicit trust. A decision for every request.
Zero Trust is a security model published by the U.S. National Institute of Standards and Technology in . Its working definition:
“Zero trust (ZT) provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.”
In that architecture, a policy engine decides, a policy administrator carries the decision, and a policy enforcement point opens or closes the path between a subject and a resource. The unit of decision is .
02 · THE RISK NIST NAMES
An agent can be talked into acting.
Section 5.7 of the same document addresses AI and other software agents, which NIST calls non-person entities (NPE):
“The associated risk is that an attacker will be able to induce or coerce an NPE to perform some task that the attacker is not privileged to perform.”
The agent may hold valid credentials and a legitimate session. Access is granted. The question that remains is the one Zero Trust leaves open at the level of a single act:
03 · WHAT IRONPROOF ADDS
The same principle, one level down.
Ironproof applies the Zero Trust idea to the action itself. A compliant action goes through without friction; an action the policy does not permit never runs. For an action that goes through Ironproof, the decision is made before execution, not reviewed after.
- Zero Trust (NIST SP 800-207)Verify explicitly, per requestIronproofEvery critical action is evaluated against your formal policy before it runs
- Zero Trust (NIST SP 800-207)Least privilege on accessIronproofLeast privilege on the act: the amount, the target, the sequence, not only the session
- Zero Trust (NIST SP 800-207)Policy enforcement point in front of the resourceIronproofA gate in front of the action: allow or block, nothing in between
- Zero Trust (NIST SP 800-207)Decisions loggedIronproofEvery allowed action sealed post-quantum, verifiable offline without trusting us
- Zero Trust (NIST SP 800-207)Policy written by the enterpriseIronproofThe policy itself is proven: we show the exact case where it breaks, or prove there is none
04 · WHAT IRONPROOF IS NOT
Not a Zero Trust architecture. A layer inside one.
Zero Trust is an enterprise-wide architecture. Ironproof covers one decision in it. Saying more would be a claim we cannot back.
We do not authenticate users or agents.
Who the agent is, and whether its credentials are valid, stays with your identity provider. Ironproof decides on what the agent asks to do.
We do not segment networks or assess devices.
Micro-segmentation, device posture and session control stay with your existing Zero Trust stack.
Only what goes through the gate.
An action that reaches your systems by another path is outside Ironproof's decision. The guarantee covers the actions routed through it, and says so.
05 · ZERO TRUST, APPLIED TO US
Do not trust us either.
A Zero Trust page that asks you to take the vendor's word would contradict itself. Every allowed action leaves a sealed record. You check it offline, with no network and no Ironproof code, byte for byte.
The verifier is public, along with the canonical format it checks.
ZERO TRUST
See the gate on one of your workflows
Pick one action your agents take. We write the rule with you, prove it, and hand you the record.