Zero Trust Identity and Authorization Profile (ZT-IAP v1.0)

This document defines the Zero Trust Identity and Authorization Profile (ZT-IAP v1.0), a normative security specification for identity, authentication, authorization, transport protection, proof of possession, observability, and operational practice in zero trust architectures. The profile applies to systems deployed across cloud, on-premises, hybrid, and edge environments, and provides consistent, verifiable requirements for how human, workload, device, and non-human identities — including autonomous AI agents — are identified, authenticated, authorized, and continuously monitored across heterogeneous platforms and administrative boundaries. ZT-IAP v1.0 is grounded in and profiles the following standards: OAuth 2.1, OAuth 2.0 Security Best Current Practice (RFC 9700), Financial-grade API Security Profile 2.0, NIST SP 800-63-4 Digital Identity Guidelines, NIST SP 800-207 Zero Trust Architecture, TLS 1.3, DPoP (RFC 9449), Selective Disclosure for JWTs (RFC 9901), Rich Authorization Requests (RFC 9396), OAuth 2.0 Protected Resource Metadata (RFC 9728), OpenID Federation 1.0, OpenID AuthZEN Authorization API 1.0, the Continuous Access Evaluation Profile and Shared Signals Framework (both finalized September 2025), W3C Verifiable Credentials 2.0, eIDAS 2.0, and NIST post-quantum cryptography standards FIPS 203, 204, and 205. The profile defines three security tiers to support incremental adoption, a phased adoption strategy across four phases, cloud platform mappings for AWS and GCP, and normative requirements for observability, key lifecycle management, and policy decision and enforcement architecture. It is intended as a reference profile for identity architects, platform engineers, security teams, and standards implementers.