Zero Trust is a routing decision before it is a product decision

Start with the path

Document who or what initiates a connection, which identity is available at each hop, where policy can be enforced, and what evidence will show that the control worked. This turns a broad security goal into a set of reviewable engineering decisions.

The useful diagram is not a vendor topology. It is a map of subjects, resources, trust transitions and failure behavior.

Make exceptions visible

Legacy protocols, service accounts and operational recovery paths often sit outside the ideal access model. Record them explicitly, assign an owner and define the evidence needed to retire or contain each exception.

An exception register is more honest and more actionable than a diagram that implies every flow already meets the target state.

Validate from both sides

Test allowed and denied paths, then confirm the decision appears in the telemetry used by operations. A control that blocks traffic but leaves investigators without context is only partially implemented.