Evaluate an offline first-match identity/resource scenario while preserving unknown MFA or device evidence.
Security
Zero trust access-policy lab
Evaluate an offline first-match identity/resource scenario while preserving unknown MFA or device evidence.
Example inputs · Replace these with your measurements to build your plan.
Use allow/deny. * matches any; MFA/device conditions are true/false/*; risk sets use |.
Method, example and sources
Compare group, resource and supplied risk with each rule in order.
Evaluate required MFA and device conditions using three-valued context.
Stop with unknown when missing evidence could change the first match.
Apply the first definitive match or implicit deny without enforcing any real session.
Worked example. The default engineering repository scenario is allowed by rule 1. Setting device evidence to unknown produces an unknown decision instead of a verified allow or silently skipping that rule.
This educational first-match policy has no connection to an identity provider or enforcement point.
Scenario decision
allow
First applicable rule
1
Device context
true
MFA context
true
An unknown condition stops evaluation when it could change the first match; it never silently turns into a verified allow.
This simplified language is not a vendor policy export. Identity, posture, session risk and continuous authorization need live evidence in a deployment.
From the catalog
Network Security & Firewalls
Explore related listings, then confirm the exact model requirements against your plan. These listings are not an automatic compatibility or capacity verdict.
Zero trust decisions depend on evidence about the subject, device and requested resource rather than network location alone. This educational rule language demonstrates that relationship with a concrete access request. Conditions are checked in order, and the result identifies the first applicable rule so policy order remains visible.
What to verify next
Unknown evidence is materially different from a failed check. If missing context could determine the first match, this lab stops and asks for review rather than manufacturing an allow decision. It does not contact an identity provider, validate a token or enforce access. Real policies also need lifecycle, session monitoring, risk evaluation and platform-specific testing under the organization's security architecture.
Worked example
The default engineering repository scenario is allowed by rule 1. Setting device evidence to unknown produces an unknown decision instead of a verified allow or silently skipping that rule.
