Let’s cut the bullshit. The NSA dropped its first Zero Trust Implementation Guidelines (ZIGs) back in January 2026, and I’ve been watching the community tear them apart ever since. The Primer is solid, but most teams are reading it wrong.
The core insight everyone misses: trust is evaluated at the Activity Level. Not the user level. Not the device level. Every single action — every SQL query, every API call, every file read — gets its own trust decision. That’s not what your vendor’s sales deck is telling you.
What NSA’s “Activity Level” Actually Means
The ZIG methodology defines the Activity Level as the lowest granularity for trust evaluation. Traditional IAM says “this user is an admin, they can do admin things.” Zero trust says “this user, on this device, from this network, at 3 AM, trying to read the customer database — is that acceptable?”
We hit this exact wall during a microservices migration last year. One of our SREs had legitimate SSH access. He got phished. The attacker used his session to pivot laterally. Identity didn’t change. Context did. That’s the whole damn point.
Hacker News had a thread about this — someone pointed out that evaluating every request through a policy engine blows up latency. They’re not wrong. Our P99 went from 12ms to 210ms. We fixed it with local policy caching and async audit logging, got it back to 45ms. But it took three weeks of tuning.
The Five Stages: Don’t Skip Step One
Here’s my translation of NSA’s five-phase approach, with the gotchas I’ve seen:
| Phase | NSA Name | What It Really Means | Common Failure Mode |
|---|---|---|---|
| 1 | Define Protect Surface | Figure out what actually matters | Defining the entire network as the surface = doing nothing |
| 2 | Map Transaction Flows | Who talks to who, and how | Guessing instead of packet-capturing |
| 3 | Build Zero Trust Architecture | PDP/PEP separation | Single-point-of-failure on the policy engine |
| 4 | Create Zero Trust Policy | Least privilege at scale | Over-slicing permissions, ops team drowns in approvals |
| 5 | Monitor and Maintain | Continuous validation, automated response | Alert fatigue, ops mutes everything |
Phase 1 is where 90% of teams fail. You can’t zero-trust everything at once. Pick your crown jewels. For us, it was the payment API and the customer database. We micro-segmented those first. Everything else got a lighter touch.
The Real Talk from the Community
There’s a Show HN for CambiOS — a Rust-based zero-trust OS. Only 8 points, but one comment stuck with me: “Zero trust is fundamentally anti-human. We want convenience, it demands friction.”
That’s the truth no vendor will tell you. Every access requires MFA. Every request re-evaluates authorization. It’s friction by design. But in 2026 — with AI agents running wild, API abuse skyrocketing, and supply chain attacks hitting every week — you don’t have a choice.
Another thread discussed Anthropic’s zero trust testing for AI agents. The consensus: bearer tokens are a disaster waiting to happen. An agent can call itself, leak its own token, and you’d never know. We ran into this with our internal AI coding assistant. The agent got a token with production log access. Almost caused an incident. Fix: short-lived credentials (15 min TTL), per-agent service accounts, and a strict API allowlist.
FAQ: Hard Answers to Common Questions
Q: Do I need micro-segmentation to do zero trust? A: No. NSA’s ZIG says start with the protect surface. If you’ve got two critical databases, network ACLs + application-layer auth gets you 80% there. Micro-segmentation is a tool, not a requirement.
Q: Is SASE the same as zero trust? A: No. SASE is a network architecture. Zero trust is a security model. NSA’s guidelines explicitly call out PDP/PEP separation as the core. A rebranded VPN is not zero trust.
Q: How does a small team start? A: Phase 1. Find your protect surface. Map flows manually. Use open-source tools — OpenZiti or WireGuard + OAuth2 Proxy. Don’t buy a $500K commercial suite. You’ll shelf it in six months.
Q: How do AI agents fit into zero trust? A: This is 2026’s new headache. Each agent gets an independent service account with just-in-time permissions. Every API call hits the policy engine. Critical rule: agents cannot modify their own permissions.
Bottom Line
The NSA ZIGs are good. But they’re written for DoD and NSS communities. The Target-level maturity requirements will crush a normal enterprise. My advice: take the methodology, cut 70% of the compliance overhead, keep the Activity Level trust concept, and pilot on one business line.
Zero trust isn’t something you buy. It’s something you grind out. Don’t let the vendors convince you otherwise.