Zero trust

Also written: never trust, always verify

Trusting no request because of where it comes from: each request's identity, device and permission is checked every time, and access is granted to one app at a time. The design also assumes an attacker is already inside.