Explain the execution flow of a Zero Trust access request from device to resource?

A single access request passes through a consistent sequence of checkpoints before any data flows, regardless of which specific technology implements each step.

sequenceDiagram
    participant D as Device/User
    participant PEP as Policy Enforcement Point
    participant PDP as Policy Decision Point
    participant PIP as Policy Info Sources
    participant R as Resource

    D->>PEP: Request access to resource
    PEP->>PDP: Forward identity, device posture, resource context
    PDP->>PIP: Query threat intel, behavior history, compliance data
    PIP-->>PDP: Return contextual signals
    PDP-->>PEP: Allow / Deny / Step-up decision
    PEP->>R: Establish scoped, enforced connection (if allowed)
    PEP-->>D: Session active, continuously monitored

1. The device or user initiates a request, which the PEP intercepts rather than forwarding directly.
2. The PEP packages identity, device posture, and requested resource details and sends them to the PDP.
3. The PDP's Policy Engine pulls in supporting signals, threat intelligence, behavioral baselines, compliance status, and evaluates them against policy.
4. The Policy Administrator translates that evaluation into a concrete instruction, and the PEP either establishes a scoped connection or denies it.
5. Once active, the session remains subject to continuous reassessment, not a one-time grant.