Identity is the most important starting point for Zero Trust because access decisions only become trustworthy when the organisation has confidence in who or what is requesting access, how that identity is governed, and what assurance exists at the time of the request.

UNIFY helps organisations move beyond login-centric thinking. In practice, Zero Trust identity needs to combine lifecycle, governance, authentication, federation, and control evidence into one coherent operating model.

What Zero Trust identity should deliver

Know who is requesting access
Build confidence in workforce, privileged, partner, customer, and federated identities before access decisions are made.
Control lifecycle and ownership
Ensure identity creation, change, suspension, and removal align with authoritative sources, governance expectations, and operational reality.
Strengthen authentication and assurance
Use modern authentication, federation, policy, and contextual access controls to improve trust without relying on static assumptions.
Reduce fragmented identity risk
Avoid disconnected identity silos that weaken auditability, increase access risk, and slow down modernisation.

Identity Domains

Zero Trust identity work usually has to account for more than one type of user or access relationship:

Identity domains that matter

Workforce identities
Employees, contractors, and contingent workers whose lifecycle and access need to stay aligned with real organisational change.
Privileged identities
Administrative and elevated identities that require stronger governance, tighter policy, and clearer evidence of appropriate use.
External and federated identities
Partners, suppliers, guests, and trusted external users who still need controlled access to enterprise services.
Complex or non-standard identities
Identity types that do not fit a simple HR-driven workforce model and therefore need explicit ownership and control decisions.

What This Means In Practice

Strong Zero Trust identity architecture usually includes:

  • authoritative source and lifecycle decisions that align identity changes to real business events
  • authentication and federation patterns that reduce trust in static network assumptions
  • access policy and assurance controls that consider more than just possession of credentials
  • governance and auditability strong enough to support both operations and oversight