Zero trust components: policy engine, administrator and enforcement point

In NIST's zero trust architecture, three logical components handle each access request. The policy engine decides, the policy administrator sets up or tears down the connection, and the policy enforcement point sits in the path and allows or blocks the traffic. Together the first two form the policy decision point.

The three components

NIST SP 800-207 describes them like this.

Policy engine (PE). Responsible for the final decision to grant access to a resource for a given subject. It uses enterprise policy and input from external sources, such as continuous diagnostics systems and threat intelligence, in a trust algorithm to grant, deny or revoke access. It makes and logs the decision.

Policy administrator (PA). Executes the decision. It establishes or shuts down the communication path between subject and resource by commanding the enforcement points, and it generates any session specific credential or token the client uses. NIST notes some implementations treat PE and PA as one service.

Policy enforcement point (PEP). Enables, monitors and eventually terminates connections between a subject and a resource. It can be a single component or split between a client side agent on a laptop and a resource side gateway in front of the resource.

The components talk over a separate control plane, while application data travels on a data plane.

One request, step by step

1. A user on a laptop asks to open an internal application.
2. The request reaches the PEP, which forwards it to the PA.
3. The PE evaluates it: who is the user, what is the device state, what policy applies, what do outside sources say?
4. The PE approves or denies and logs it.
5. If approved, the PA configures the PEP to let the session begin, possibly issuing a short lived credential.
6. If risk changes mid session, the PE can revoke, and the PA tells the PEP to shut the connection.

What feeds the decision

The PE relies on supporting systems: asset and device posture, identity and access management, activity logs, threat intelligence and policy data. NIST warns that gaps here lead to denied requests, because the engine cannot decide without information. This is why accurate inventory matters, a theme in zero trust first steps.

Mapping to things you may already run

• Identity provider and conditional access rules often act as PE and PA for web apps.
• A reverse proxy or access gateway is a PEP.
• An agent on laptops reports device state.
• Service meshes and mutual TLS can enforce identity between workloads. See mutual TLS explained.

This mapping is illustrative. Check each product's documentation to see what it really decides and enforces.

Quick check

Sources

• NIST SP 800-207 full text (PDF)
• NIST SP 800-207, Zero Trust Architecture

Last reviewed: 19 October 2026.