Zero Trust: verify explicitly, use least privilege, assume breach

Signals you can use

Use multiple signals to decide how much access to grant. Identity (who is requesting). Sign-in risk and anomalies. Device compliance/health. Location and network context. Resource sensitivity (what's being accessed).