Zero trust
A security and governance design principle where trust is never granted permanently based on location or prior verification (being "inside the network," "already in the warehouse"), but is instead checked continuously, at the point of each specific use, based on current, verifiable signals. Originated in network security (Google's BeyondCorp is the canonical published example) and applies directly to data governance: provenance and quality are verified at use, not assumed durable from onboarding.
Defined in 3 GAGE programs, which carry 4 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
A security and governance design principle where trust is never granted permanently based on location or prior verification (being "inside the network," "already in the warehouse"), but is instead checked continuously, at the point of each specific use, based on current, verifiable signals. Originated in network security (Google's BeyondCorp is the canonical published example) and applies directly to data governance: provenance and quality are verified at use, not assumed durable from onboarding.
A security model that never trusts by default and always verifies: never trusting data without validation, a model without testing, an integration without monitoring, or access without authentication, applied in identity, access, data, network, and monitoring layers.
An architecture defined by seven published tenets, including that network location alone does not imply trust, that access is granted per session with least privilege, and that no asset is inherently trusted. A programme rather than a product.
An architectural approach, formalized in NIST Special Publication 800-207, in which no user, device, or network location is trusted by default; every access request is authenticated, authorized, and continuously verified based on identity, device posture, and context, regardless of whether the request originates inside or outside the traditional network perimeter.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Least privilege in the estate: who can read what, and the analyst who can read everything · Access and the Keys, Certified AI Data Governance Professional (CADGP)
- Governance that survives: rebuilding the estate's defenses so the next attack finds less · Adversarial Data Governance, Certified AI Data Governance Professional (CADGP)
- Enterprise Integration Strategy · Technology, Platforms and Vendors, Certified AI Transformation Professional (CATP)
- Secure acquisition, development, and architecture governance · Cybersecurity Governance and Operational Resilience, Certified Enterprise Governance, Risk and Compliance Professional (CEGP)
Where it shows up at work
A definition is where Zero trust starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Decides where AI should be used, where it should not, and which use cases create measurable value, tied to the organization's priorities.
One lesson on this page teach it as a primary outcome.
Governs AI agents that take actions: tool access, least privilege, interruptibility, cascading actions and accountability for what an agent did.
One lesson on this page teach it as a primary outcome.
Classifies information, applies least privilege, sets retention and acceptable-use rules, and controls what may enter a prompt, a log or an embedding.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Chief Information Officer, technology leadership editionneeds it at depth
- Chief Technology Officer, AI engineering editionneeds working knowledge
- Chief AI Officerneeds it at depth
- AI Security Architectneeds it at depth · 8 open postings this week
- Chief Information Security Officer, AI security focusneeds it at depth
- AI Governance Engineerneeds working knowledge · 7 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: IMDA Model AI Governance Framework for Agentic AI; NIST AI RMF; ISO/IEC 27001; GDPR Article 5.
One interview question about it
Fifty AI ideas are on the table. How do you pick the three worth doing, and how do you say no to the rest?
Asked of candidates for ai strategy and opportunity triage. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- A business, MBA or technology management degree carries it as a claim to back up: Strategy and opportunity triage are the core of the degree.
- Privacy and data protection carries it as a claim to back up: Classification and retention rules are familiar territory.
- Cybersecurity and IT carries it as work you can show: Access governance and classification are implemented, not described.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.