In zero-trust, what constitutes 'continuous authorization'?

• A. Access rights are checked only at login.
• B. Access rights are checked for every access request at the start of each session.
• C. Access rights are checked periodically but not during each action.
• D. Access rights are checked per access request throughout the session.

Answer: (D)

In zero-trust, continuous authorization means that every access attempt is evaluated in real time throughout the entire session. Trust is never assumed, so with each action, the system re-checks who is requesting, from what device, the resource being accessed, and the current risk and context. This allows immediate denial or adjustment if conditions change—like a device becoming non-compliant or a risky activity being detected—maintaining strict, ongoing control.

If access were only checked at login, or only at the start of a session, or only periodically, opportunities to bypass or misjudge risk could arise during the session. Continuous per-access checks ensure protection for each operation as it happens.