Applying Zero Trust to Software: The Gap Between Provenance and Permission
Zero Trust has reshaped how organizations think about access. No user is trusted by default and no device gets a free pass. Every request is verified before access is granted. It is a sound principle, and it stops short of software artifacts.
What Zero Trust currently misses
Zero Trust governs identity, network, and device posture. It does not govern what software does when it executes. An artifact that clears every origin check, signed, sourced from an approved repository, delivered through a trusted vendor, still runs without any evaluation of what it is capable of doing.
That is a gap the current model was not designed to close.
Origin is not authorization
As Ken Ammon argues in his Forbes piece, SBOMs tell you what is inside an artifact. Signing tells you who signed it. Provenance tells you how it was built. None of those answer whether it should be allowed to run.
Consider this: a security team receives a software update from a vendor they have worked with for years. The package is signed. The source is verified. The SBOM is accurate. The artifact also contains routines capable of establishing persistence and communicating with external infrastructure. Every provenance check passes. None of them surface the capability that matters.
Origin answered. Behavior never asked.
The pattern holds across the threat landscape
This is not a hypothetical. The Arch Linux AUR compromise and the WordPress CDN breach both followed the same structure: trusted source, legitimate delivery, malicious execution. In both cases, every origin check passed. In both cases, the behavior was never evaluated before the code ran.
We laid out what Zero Trust for Code actually requires in practice in Zero Trust for Code Starts With Understanding Intent. The supply chain keeps working as an attack vector because the trust model for software execution has not caught up to how attackers operate.
What changes when you evaluate before execution
Behavioral analysis before execution closes that gap. Control flow, dataflow, and system interactions are assessed before the artifact runs. The output is a deterministic verdict, Allow, Block, Restrict, Quarantine, or Require Review, with the evidence documented.
That is Zero Trust applied to software. Trust based on what an artifact will do, evaluated before it runs.
Ken Ammon makes the full argument in his Forbes article, “Security Has a Timing Problem, But Attackers Don’t.”
