Overview of the ZPL Policy Language

ZPL (pronounced "zippel") is an acronym for Zero-trust Policy Language.ZPL is used to define security policies for network communication that are independent of network configuration.The policies ZPL defines are enforced across a group of interconnected networks called a ZPRnet.The policies are defined in terms of the attributes of the communicators.ZPL provides a way to express two different types of statements related to security policy: permissions that allow communication under specific circumstances, and declarative assertions about the intent of the policies.A ZPL compiler checks that the permissions are consistent with the assertions and then generates enforcement rules for implementing the policies.Any communication through a ZPRnet must be specifically allowed by a permission statement.Permissions state what is allowed to happen, rather than disallowing things that should not happen.ZPL uses assertions of intent to ensure that the permissions do not allow unintended communication.For example, a permission statement might allow managed laptops to be used by cleared government employees to access classified databases.An assertion of intent might state that no one without proper clearances is allowed to access a classified database.The ZPL compiler will ensure that there is no permission that violates the assertions of intent.The permission example above would be expressed in a single ZPL statement that gives devices with specified attributes (the laptops) operated by users with specified attributes (the cleared employees) access to services with specified attributes (the classified databases).Since ZPL polices are stated in terms of attributes of the communicators, not network addresses, a database server could be moved anywhere within the ZPRnet, say from one cloud to another or from on-premises to the cloud, without any change in security policy.Trusted sources of information are used to determine the values of attributes the communicators.The ZPL compiler combines policy statements with a configuration description and attribute values from trusted sources to generate enforcement rules that implement the security policies.The compiler also verifies that the policy rules and attribute values are consistent with the intents expressed in the assertions. Key ConceptsIt is helpful to understand a few of the key concepts mentioned above in more detail before diving into the syntax of ZPL.After reading this section, it may be worth rereading the introduction. What is a ZPRnet?ZPL security policies apply to a network or a group of co-managed interconnected networks, such as an enterprise's internal networks and cloud tenancies.The network or group of networks over which the security policies apply is called a ZPRnet.ZPL specifies the policies that are enforced throughout the ZPRnet.