An architect designing a Zero Trust model separates the component that evaluates identity, device posture, and policy to decide whether a request is allowed from the component that actually opens or blocks the connection to the resource. Which component makes the access decision?

Zero Trust architectures divide responsibilities between a control plane and a data plane. In the control plane, the policy decision point, made up of the policy engine and the policy administrator, gathers signals such as user identity, authentication strength, device health, threat intelligence, and policy, then decides whether a specific request should be allowed. The administrator communicates that decision to the data plane. The policy enforcement point sits in the data plane, in the path between the subject and the resource, and opens, monitors, or terminates the connection as instructed; it enforces but does not originate the decision. An implicit trust zone is the area beyond the enforcement point where traffic is already permitted; it is precisely what a Zero Trust design tries to shrink, and it makes no decisions. An endpoint agent on the subject's device may report posture data that feeds the decision, but it is a signal source rather than the authority that grants access. Exam caveat: expect questions that list control plane elements (adaptive identity, threat scope reduction, policy-driven access control, policy engine, policy administrator) against data plane elements (subject or system, policy enforcement point, implicit trust zones). Operational check: trace one access request and confirm that the gateway or proxy blocks traffic until it receives an explicit allow from the central policy service.