For years, Zero Trust has been one of the most discussed ideas in cybersecurity. Yet despite the investment organizations have made in Zero Trust programmes, I felt something was missing from the conversation. Most discussions still centered on whether a user, device or service should access a resource, while organizations were confronting a broader challenge: whether applications, AI assistants and autonomous agents should retrieve information, act on someone’s behalf or complete business processes. Companies were just trying to secure access; now they are trying to secure the way people work. That observation led me to consider how Zero Trust should evolve from an access-focused security model into a workplace architecture that enables trusted work.
The Workplace Has Changed
Many traditional security models placed substantial trust in managed devices, enterprise applications and secured networks. Work now spans secured and unsecured locations, devices, SaaS platforms, cloud services and digital workspaces. AI assistants and autonomous agents extend this further by retrieving information, supporting decisions and acting across business systems. Organizations must therefore govern who and what can act, which information they may use and what outcomes they may produce, while enabling safe use, reliable knowledge and governed automation without unnecessary complexity or friction.
The Trust Decision Has Evolved
These additional components broaden how organizations must apply trust decisions. Established Zero Trust architectures already evaluate subjects, devices, assets, applications, services and resources through dynamic policy. Modern workplaces add urgency to determining whether people, applications, AI assistants and autonomous agents are authorized not only to access information, but also to perform specific actions on behalf of users or the organization.
Access does not always grant authority to act. For example, an AI assistant might be authorized to retrieve customer information and draft an account update, while the final change requires human approval. Trust decisions must therefore consider the actor, purpose, information sensitivity, device or workload state, authority and potential consequences. This broader model forms the foundation of Zero Trust Workplace Architecture.
Throughout my career in EUC and workplace transformation, I have helped organizations build secure, productive and resilient workforces across virtual desktops, endpoints, digital experience management, reporting and workplace strategies. The technologies have changed, but the objective has not: enable effective work while reducing risk. That experience shaped a simple belief: employees do not consume security controls; they consume workplace experiences. When controls are confusing or obstructive, productivity declines and users seek alternatives.
The same principle applies to governance. If approved tools and processes are difficult to use, adoption falls and shadow IT becomes more attractive. This is not about trading security for convenience, it is about designing controls around how work happens so that security, productivity, experience, resilience and innovation reinforce one another. This is where I believe modern Zero Trust needs to evolve.
Introducing Zero Trust Workplace Architecture
A Zero Trust Workplace Architecture extends established principles across the modern workplace, not as a replacement framework, but as an architectural model for coordinating signals, decisions and outcomes across identity, endpoints, data, browsers, applications, employee experience, AI, automation, governance and resilience. The aim is to support more coordinated and adaptive trust decisions for people and digital workers across the original domains and three expanded workplace domains:
- Enterprise Browser Trust: Uses browser and session context to govern access, activity and data movement across managed and unmanaged devices.
- Applications, AI and Workload Trust: Defines what applications, AI assistants, services and autonomous agents may access and do, with appropriate oversight and approvals.
- Data and Knowledge Trust: Ensures information used by people, applications and AI is authorized, current, reliable and governed.
Combined, these domains extend trust beyond access to govern how people and digital workers use information and perform actions.
The Workplace Trust Control Plane
The Workplace Trust Control Plane is a proposed logical coordination layer that brings together context from identity, devices, browsers, applications, data, AI activity and security operations. Its purpose is to enable trust decisions that draw on multiple workplace domains rather than isolated platforms.
The control plane evaluates signals such as identity, device posture, browser context, application risk, information sensitivity and authority to determine whether to permit, restrict, approve or prevent an action. It does not require a single replacement platform. It requires shared context and co-ordinated decisions that improve control consistency, reduce avoidable user friction and support faster, safer adoption of new workplace capabilities.
As people increasingly work alongside AI assistants, autonomous agents and automated services, the boundary between human and system activity will become less distinct. Organizations must align security, workplace strategy and AI governance by defining what people and digital workers may do, which information they may use and where human oversight is required. Establishing these principles early will support consistent governance without obstructing responsible innovation.
From Secure Access to Trusted Work
The future is not only about protecting resources. It is about establishing trust across people, devices, applications, information and AI-driven activity while preserving the experience employees need to work effectively. A Zero Trust Workplace Architecture is intended to support that shift by connecting security, digital experience, AI governance, resilience and business outcomes.
The next step for leaders is practical. Map where trust decisions are made today, identify the workplace domains that remain disconnected and define which human and automated actions require additional context or oversight. Bring security, EUC, digital workplace, data and AI governance leaders together to answer one question: Where does your current Zero Trust model struggle to support how work happens today? Start there, then design the path from secure access to trusted work.
To help on this journey I’ve developed a series of artifacts that outline the overall Zero Trust Workplace Architecture, how each of the domains fit in the architecture and how they can fit within your organization. Stay tuned over the coming weeks, as we delve deeper.
Whether you’re rethinking your Zero Trust model, preparing for AI assistants and agents, or trying to secure the way your people work without slowing them down, our team can help you find where to start. Contact us today and let’s talk about what trusted work looks like for your organization.
