Reinvent The Self!

Why Trust Is Not Authentication, Authorization, or Identity — but Their Alignment Over Time 

Most discussions of Zero Trust stop at slogans: 

“Never trust, always verify.” 
“Continuously authenticate and authorize.” 

These statements are directionally correct—but technically imprecise. 

What they miss is the actual invariant that Zero Trust systems are trying to preserve. 

This post articulates that invariant. 

The Misconception: Continuous Checks 

In practice, Zero Trust systems do not: 

• continuously ask who you are in a literal sense 

• continuously recompute every permission at every millisecond 

If they did, they would be unusable, expensive, and still incomplete. 

So what is actually being verified “continuously”? 

A Clear Separation of Concerns 

Let us begin with primitives. 

Identity answers: 

“Who is the entity at this moment?” 

This includes: 

• authentication state 

• identity attributes 

• risk posture 

• provenance (human, workload, device) 

Identity is latent. It exists whether or not action is taken. 

Access answers: 

“What is this entity allowed to do at this moment?” 

This includes: 

• entitlements 

• roles 

• conditional grants 

• time‑bounded or activated privileges 

Access is potential. It exists even if unused. 

Action emerges when identity exercises access. 

But trust does not. 

Trust is neither identity nor access. 

The Missing Concept: Alignment With Truth 

Zero Trust systems care about something subtler: 

Whether the currently authenticated identity and the currently authorized access are still aligned with reality at this instant. 

Reality here means: 

• organizational truth (job role, employment status) 

• security truth (risk, device posture, location) 

• temporal truth (time bounds, recency) 

• contextual truth (purpose, intent, sensitivity) 

This alignment—not the checks themselves—is what Zero Trust preserves. 

The Formal Invariant 

We can now state the invariant precisely. 

At any moment t, an action is allowed if and only if the authenticated identity I(t) and the authorized access A(t) are jointly aligned with the current system truth T(t). 

Formally (conceptually): 

1     Trust(t) ⇔ Align(I(t), A(t), T(t)) 

Where: 

• I(t) is the identity as it exists now 

• A(t) is the access held or activated now 

• T(t) is the evaluated truth of the world now 

This alignment is trust. 

Not a credential. Not a role. Not a policy. 

Why This Must Be an Invariant 

Because neither identity nor access is stable: 

• People change roles 

• Devices drift 

• Risk accumulates 

• Context shifts 

• Time passes 

A system that does not re‑validate alignment inevitably drifts into false trust: 

• identities that are authentic but no longer appropriate 

• access that is valid but no longer justified 

This is how privilege creep happens. This is how breaches persist undetected. 

What “Continuous” Actually Means 

“Continuous authentication” and “continuous authorization” are shorthand for: 

Continuous protection of the alignment invariant against drift. 

Re‑evaluation occurs when: 

• identity attributes change 

• risk signals change 

• access is activated or exercised 

• sensitive boundaries are crossed 

• time thresholds are reached 

Not constantly—but whenever truth might have changed. 

Why This Explains Real Zero Trust Controls 

This invariant explains why mature Zero Trust systems insist on: 

• PIM — because standing authorization breaks temporal truth 

• Access reviews — because access outlives its original identity justification 

• Conditional access — because access validity depends on context 

• JML workflows — because identity evolution must trigger access recalculation 

These are not features. 
They are mechanisms to keep the invariant true. 

Identity Gives Meaning to Access 

Access Gives Reality to Identity 

An identity with no access is abstract. Access with no identity is meaningless—and dangerous. 

Only their alignment in time produces: 

• legitimate action 

• accountable behavior 

• enforceable trust 

IAM exists to keep that alignment intact as both evolve. 

The Core Insight 

Zero Trust is not a system that distrusts everything. 
It is a system that mistrusts staleness. 

Trust is momentary correctness, not lasting belief. 

Closing Thought 

When we say: 

“Never trust, always verify” 

What we really mean is: 

Never assume alignment persists. 
Always be prepared to re‑establish it. 

That is the Zero Trust invariant. 

And that is what modern IAM systems are ultimately built to protect.