Community

There isn’t a single, standalone protocol that everyone calls “Zero Trust Authorisation Protocol.” Zero Trust is a security architecture and mindset—“never trust, always verify”—rather than a formal RFC-defined wire protocol. What you’ll actually see in production are protocol stacks and policy engines built to enforce Zero Trust principles:

• Authentication & Federation:

  • OIDC / OAuth 2.0 – Used for delegated auth with continuous verification.

  • SAML 2.0 – Older but still used in enterprises.

  • FIDO2/WebAuthn – Phishing-resistant, passwordless auth for Zero Trust endpoints.

• Policy Decision/Enforcement:

  • XACML or OPA (Open Policy Agent) – Express fine-grained, attribute-based access control (ABAC).

  • SPIFFE/SPIRE – Secure workload identities in service meshes.

  • gRPC/Envoy + mTLS – For microservice-to-microservice trust with certificate rotation.

• Zero Trust Frameworks/Specs:

  • NIST SP 800-207 – The de facto reference for Zero Trust architecture.

  • CNCF Zero Trust Working Groups – Define patterns for cloud-native stacks.

  • Google BeyondCorp – A reference implementation (not a protocol) showing continuous verification of user, device, and context.

So if you’re looking for one standardised “Zero Trust authorisation protocol,” it doesn’t exist. The industry achieves Zero Trust by composing existing protocols (OAuth 2.0 + OIDC + mTLS + ABAC/RBAC engines) under strict “verify every access, every time” policies. If you need a starting point:

1. NIST SP 800-207 – for architecture principles.

2. OAuth 2.0 + OIDC with continuous re-auth and device posture checks.

3. OPA or XACML for dynamic, context-aware authorisation decisions.

4. mTLS/SPIFFE for workload identities inside your network.

That’s the current state of play—Zero Trust is a design pattern, not a new protocol.