Zero trust Being on the office network earns no trust. Every request is checked.
Short answer. Zero trust is a security approach that assumes no user, device or network location is trusted by default. NIST SP 800-207 describes it as a set of ideas designed to minimise uncertainty in enforcing accurate, least-privilege, per-request access decisions in the face of a network viewed as compromised. Sitting inside the office network earns no trust. Each request is authenticated and authorised, access is granted per session with the least privileges needed, and the state of the device counts. For an office AI box, a staff laptop on the office Wi-Fi still signs in as a named user, and the box shows only what that user may see.
01
NIST’s seven tenets, in office terms
NIST SP 800-207 (August 2020) lists seven tenets. NIST calls them the ideal goal and says not all may be fully implemented in their purest form.
Tenet (NIST SP 800-207)
In an office
1. All data sources and computing services are resources
The AI box, the file server, a printer and every cloud tool are things to protect, not only the main server
2. All communication is secured regardless of network location
Use HTTPS between a laptop and the AI box even on the office LAN
3. Access is granted per session, with least privilege
Signing in to the accounts system does not open the AI documents
4. Access is decided by dynamic policy
Rules can weigh the user, the app, the device and the time
5. The enterprise monitors the integrity and security posture of all assets
Patched, managed devices get more access than unknown ones
6. Authentication and authorisation are dynamic and strictly enforced
Multi-factor sign-in, and a re-check when something changes
7. The enterprise collects information to improve its security posture
Sign-ins, requests and refusals are logged and reviewed
02
What zero trust is not
It is not a product you can buy. NIST calls it a set of guiding principles rather than a single architecture, and says the move to it is a journey that cannot be done by wholesale replacement of technology. CISA’s Zero Trust Maturity Model, version 2.0 (April 2023), says the path is incremental and may take years.
It does not mean removing the firewall. NIST expects most enterprises to run in a hybrid zero trust and perimeter-based mode for some time. What changes is that the perimeter stops being the only line of defence. NIST notes that, once attackers breach a perimeter, further lateral movement is unhindered.
03
Five areas to work on
CISA’s model groups the work into five pillars. The right-hand column suggests a first step for each in a small office.
CISA pillar
A first step in a small office
Identity
Individual accounts for everyone, no shared logins, multi-factor sign-in on email and admin accounts
Devices
A list of every laptop and phone that reaches office systems, kept patched, with disk encryption
Networks
Separate guest Wi-Fi and cameras from staff devices, and give the AI box its own segment
Applications and workloads
Least-privilege accounts and separate API keys for each tool and agent
Data
Know which documents are sensitive, restrict them, and log who opens them
04
How an AI system fits
An AI system adds a new kind of subject: software acting for a person. Zero trust applies to it too. An agent should run with the permissions of the user who asked, each tool call should be authorised in the downstream system rather than trusted because the model requested it, and every call should be logged. OWASP’s guidance on excessive agency says the same in other words.
05
Where ANVE stands
ANVE is built for many named users, and logs every model call with the user, the app, the model and whether it ran locally or in the cloud: every answer cited, every action owned, every model call logged. Its security page (/security) says roles today are administrator and user, with teams, finer roles and single sign-on not on ANVE yet, and that cloud models, connectors and agent tools each need an administrator’s approval. ANVE is pre-release and has no certifications.
06
Questions people ask
Is zero trust a product I can buy?
No. NIST describes it as guiding principles. Vendors sell tools that help, but zero trust is the way you decide who may reach what.
Does zero trust mean no firewall?
No. NIST expects most enterprises to run a hybrid of zero trust and perimeter defences. The firewall stays; it just stops being the only check.
Is zero trust a legal requirement in India?
Not as a named requirement in the sources here. The DPDP Rules, 2025 require reasonable security safeguards, including access control and logs (rule 6), from about May 2027, and zero trust practices help with them. This is general information, not legal advice.
Where should a small office start?
With accounts and devices: individual sign-ins, multi-factor authentication and a list of devices that are kept patched. CISA says the path to zero trust is incremental.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
