Zero Trust follows one principle: never trust, always verify. You don't grant access based on network location. Being inside the corporate network doesn't make you trusted. Being on a VPN doesn't either.
Every access request requires authentication and authorization. You verify the user's identity, check their device health, evaluate the context of their request, and enforce least privilege. This happens continuously, not just at login time.