Overview
NIST SP 800-207 describes zero trust as an architecture, not a product: no implicit trust, a policy decision for every request, and enforcement close to the resource. Applied to documents, that means the document itself becomes the resource — and the viewer becomes the policy enforcement point.
What the standard actually says
The publication defines zero trust around a simple shift: stop assuming that anything inside the perimeter is trustworthy. Every request is evaluated on identity, device, context, and policy, and access is granted per session rather than per network location.
Its architecture has two moving parts: a policy decision point (PDP) that evaluates the rules, and a policy enforcement point (PEP) that allows or blocks the request. The PDP can be centralized; the PEP must sit where the resource is reached.
The document is deliberately generic. It talks about data sources and computing services, not PDFs. That is why applying it to documents requires translation — and why many zero-trust products stop at network access.
- No implicit trust — location, VPN, or employee status are not authorization.
- Per-request decisions — access is evaluated for each action, not once at login.
- Assume a hostile network — encrypt, authenticate, and verify continuously.
Mapping the tenets to a document
The resource is the document and its metadata: pages, versions, classifications, and the policy attached to them. The PEP is the component that renders or blocks each page. The PDP is the policy engine that answers whether this user, on this device, at this time, may see this page.
That changes the unit of control. A folder permission says who may open a container. A zero-trust document policy says who may see a specific page in a specific session — and can change the answer while the document is open. The test is practical: if revoking a folder permission does not stop the next page, the control was never per request.
Delivery matters as much as authorization. If the original file reaches the endpoint, the PEP only controlled the first request; the copy is outside policy. Server-side rendering, session watermarking, and revocation keep the decision in force after the page is displayed.
The document policy enforcement point
A traditional document management system authenticates at the door and then trusts the session. A zero-trust PEP re-checks every page request and records the decision. If the policy changes, the next page fails.
That requires determinism: the same inputs must produce the same allow/deny answer, and the rule must be inspectable before it ships. Aegis Shield is the PDP in our stack; the viewer is the PEP.
- Authenticate the user and, where possible, the device.
- Authorize the specific document and page against policy.
- Render only what the decision allows, with a session watermark.
- Record the decision and the view for later evidence.
Deployment and evidence
Zero trust does not require a cloud. For public institutions, the PDP and PEP can run on-premise or air-gapped, inside the same boundary as the documents. That is often the only way to satisfy sovereignty requirements while keeping per-request enforcement.
Evidence is part of the architecture. The standard asks for telemetry and continuous monitoring; in document terms, that means an exportable audit trail of who requested what, which policy decided, and what was rendered. Digital chain of custody is the public-sector version of that record. That record is also what turns a policy debate into an incident review.
A practical roadmap starts with the documents whose exposure is unacceptable: board packs, bids, citizen records, clinical files. Apply the full PDP/PEP model there, measure the friction, then expand. Trying to boil the ocean is how zero-trust programs stall.
- Start with crown-jewel documents, not every file share.
- Keep the PEP close to the document — on-premise or air-gapped where required.
- Export the evidence an auditor or regulator can read.
- Test the deny path — the policy is only real when it says no.
A checklist for the first document workflow
Pick one workflow and answer these questions before buying anything. The answers will tell you whether you need a network product, a document platform, or both.
- What is the resource: a folder, a document, or a page?
- Where is the policy decision made, and who can inspect it?
- What reaches the endpoint: the original, a rendered page, or nothing?
- Evidence — what remains after a denied request and after a leak?
NIST SP 800-207 is useful precisely because it refuses to sell a product. It describes a discipline: decide per request, enforce near the resource, and keep evidence. Documents are one of the places where that discipline matters most, because the resource is easy to copy and hard to recall. If you are mapping zero trust to a document workflow, request a demo and we will run the PDP/PEP model against your own files. Start with Zero Trust for documents and Aegis Shield.