GLOSSARY
Zero trust
Zero trust is a security approach that evaluates access to resources using verified identity, authorisation and context. Membership of a corporate network is insufficient on its own. The relevant question is who may access which information or function under particular conditions.
Sales support with changing participants
An external consultant needs to prepare a proposal. They require certain product documents, but may have no reason to access other customers’ contracts or send the final offer. AI assistance must observe those boundaries. Being technically able to call a tool does not grant permission for a broader action.
Permissions should therefore be limited to the task and enforced where actions occur. A policy engine can support decisions using defined rules. Changes to roles, projects or access must take effect promptly. Clear routine tasks can then be automated, with appropriate approval for actions carrying greater consequences.
Testing the working process
Useful tests include withdrawn permissions, expired sessions and deliberately prohibited access attempts. Assess whether data and actions remain protected across background processes and connected services. Tenant isolation is a related aspect requiring its own assessment. Zero trust describes design principles and their implementation; a product label supplies no comprehensive security evidence. Operations still need accountable owners, verifiable rules and controlled exceptions.