IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Zero trust & context — never trust, always verify
Old security was a castle. Once you were inside (the office network, a VPN or an approved IP address), you were trusted. Zero trust removes that trust. Every access is checked on its own. Your goal: explain zero trust, context, PEP/PDP/PIP and continuous evaluation.
- Never trust, always verify. Check every access.
- Context (who, what device, where, when, risk) feeds each decision.
- The answer is allow, step-up or deny.
- If context changes mid-session, judge the session again at once.
an airport, not a castle. Your boarding pass is checked at check-in, at security and at the gate. Every checkpoint, every time. Being inside the terminal does not let you walk onto any plane.
Context: the signals behind a decision
Zero trust uses context: the signals around a request.
- Who is asking? Check the persona and assurance level.
- What device is it? Is it updated, managed, or tampered with?
- Where is it? Check the place and network.
- When is it? Check shift hours.
- How risky does it look? Check for recent fraud signs.
A policy engine puts the signals together. ZTNA (zero-trust network access) products enforce the answer at the network. The result is one of three: allow, step-up (prove more) or deny.
Same Sam, same password. At his shop terminal at 10 a.m.: allowed. From an unknown laptop at midnight, abroad: denied. On his own phone at a partner kiosk: allowed, but only after a step-up and only for low-risk apps.
Who decides? PEP, PDP and PIP
There are three jobs.
- The PEP (policy enforcement point) is the gate. It lets a request through or stops it.
- The PDP (policy decision point) is the judge. It decides.
- The PIP (policy information point) holds the facts the judge needs. The identity fabric is the best source.
Picture a housing society gate. The watchman is the PEP. The secretary who says yes or no is the PDP. The resident list and visitor book are the PIP.
Judge again when things change
A normal session is judged once, at login. With continuous access evaluation, the session is judged again at once when the context changes. For example, risk jumps, a device is reported stolen or a persona is unlinked. The signals that make this possible are CAEP and Shared Signals (from OpenID). The CAEP lesson tells that story.
Zero trust is not a product you buy once. If any door still says "you came from the office network, come in", the castle is back. Every checkpoint must keep asking.
Go deeper: policy engines
The judge's rulebook often lives in a dedicated policy engine. Three names to know. Open Policy Agent (OPA) uses general rules in a language called Rego. Cedar is a policy language for permissions. OpenFGA is the relationship kind that powers ReBAC from the personas lesson.
The syntax differs, but the idea is the same. Policies sit in version control. They are reviewed and tested like code. Every decision is logged.
🧪 Interactive lab — enable JavaScript to play with this one.
Continuous access evaluation uses CAEP and signed Security Event Tokens. Check whether your IdP can send and receive them with SSF Check.