ZTNA grants access to individual applications and resources based on verified identity and policy, rather than putting a user on a trusted network. Every connection is authenticated, authorized and encrypted, and access is brokered per-resource so there is no flat network to move laterally across. Identity, not IP address, becomes the perimeter.

A VPN authenticates you once and drops you onto the network, where you can often reach far more than you need — great for attackers who steal a session. ZTNA never exposes the network; an identity-aware proxy brokers access to one resource at a time, re-evaluating policy and posture per request. The result is least-privilege connectivity instead of all-or-nothing tunnels.

An identity-aware proxy sits in front of servers, databases, Kubernetes clusters and web apps, authenticating the user, checking policy, and issuing short-lived credentials while recording the session. Teleport is an open-source implementation of this pattern. The Teleport labs broker access to infrastructure with certificate-based identity and full session audit.

A policy decision point (PDP) evaluates a request against policy and returns permit or deny; a policy enforcement point (PEP) is the gate that intercepts the request and enforces that decision. Separating them lets you centralize policy logic (often with OPA) while enforcing it consistently at many gates. The zero-trust architecture lab composes an IdP, PDP, PEP and telemetry into one flow.

Device posture is the health and trustworthiness of the device making a request — disk encryption, patch level, EDR presence, managed status. Zero trust uses posture as a signal alongside identity, so a valid user on a jailbroken or unmanaged device can be stepped up or blocked. Posture attestation closes the gap where stolen credentials alone would otherwise be enough.

BeyondCorp is Google's zero-trust model that removes the privileged corporate network entirely: every request is authenticated and authorized based on user and device trust, from any network, with no VPN. It popularized the idea that access decisions should depend on who and what is asking, not where they are connecting from. The reference-architecture lab draws on these principles.

It is an architecture that several products implement. Teleport, Cloudflare Access and Zscaler ZPA are all ZTNA implementations, but the underlying pattern — identity-aware, per-resource brokering with continuous policy evaluation — is what matters and what transfers between tools. The labs teach the pattern first so you are not locked to one vendor's console.