I'll use an airport analogy to explain Zero Trust and then explain how this applies, in practice, to critical infrastructure operations in cyberspace and what is needed to implement Zero Trust in practice.
Imagine you are flying somewhere on vacation. You buy your ticket and eventually get your boarding pass, which authorizes you to fly on a plane in an assigned seat.
On the day of your flight you arrive two hours before departure and approach the "TSA Security Checkpoint" where you are required to present your identity to the agent, i.e. a Passport or RealID. The TSA Agent checks your asserted identity and if everything passes you are allowed to access the gate area.
Congratulations you just passed your "Zero Trust Check" as part of MFA verification.
Now the next check takes place where the Gate Agent verifies your boarding pass is legitimate and you take your assigned seat (your allowed permissions)
These same concepts also apply to a Zero Trust MFA implementation in cyberspace.
You start by using your computer to initiate a request to use a cyber resource that is protected by Zero Trust, which requires you to present your Zero Trust identification, i.e. ZTDNAID, to the Zero Trust Gateway protecting the Resource, i.e. ZTBouncer. The Gateway checks your asserted ZTDNAID against a PTI Trust Registry to verify that you are indeed trusted and may proceed to the next step. Assume the next step is logging into a database, like Postgres. Now you must present your other MFA credentials to the database application, i.e. your valid Postgres username and password, and you are granted access to use the database.
Zero Trust (ztdnaid) verification is an effective MFA solution when combined with other credentials, i.e. Postgres username/password
A Zero Trust identifier needs to be verified as trusted, not authenticated like a login credential.
The organization that grants Zero Trust DNAID's, i.e. your employer, assigns you a ZTDNAID that travels with you everywhere in cyberspace, like a Passport. You present this ZTDNAID to every Zero Trust Gateway you encounter and your trusted access to a Resource is confirmed or denied. If you are denied access then you are stopped from going further - never reaching the actual database you wish to access. If you are confirmed then you proceed on and login to the database using your assigned credentials.
The Zero Trust Gateway protecting a Resource verifies that your ZTDNAID (your passport to cyberspace) is included in a Zero Trust Bond record in SAG-CTR representing a "trust relationship" with the Resource you are requesting access to. Three objects are needed in the PTI Trust Registry to perform the Zero Trust check, your Entity ZTDNAID, assigned by your employer, the Resources ZTDNAID, also assigned by your employer/Resource Owner, and a Zero Trust Bond record that grants your Entity ZTDNAID specific access to the Resource ZTDNAID. If no ZTBOND record exists in the SAG-CTR Trust Registry then all communications cease and the Entity is denied access to the Resource.
Here is an example overview showing how Zero Trust practices can protect REST API's across cyberspace. https://github.com/rjb4standards/Presentations/raw/refs/heads/master/ZTDNAID-Throttling-proposal.pptx