Trust No One, Verify Everyone: An Identity-Centric Adaptive Framework for Zero Trust Architecture

Traditional perimeter-based security relies on implicit trust and is increasingly ineffective against credential compromise, insider threats, and lateral movement in cloud and distributed environments.Zero Trust Architecture (ZTA) eliminates this implicit trust by continuously verifying identities, devices, and access requests.This paper investigates Identity and Access Management (IAM) as the foundation of ZTA, examining authentication, authorization, least-privilege access, human and non-human identities, and modern access-control models including RBAC, ABAC, ReBAC, and PBAC.It further integrates context-aware risk assessment and Continuous Access Evaluation (CAEP) to address dynamically changing security conditions.Based on this analysis, the study proposes an identitycentric adaptive Zero Trust framework that combines identity verification, contextual risk assessment, policybased authorization, and continuous access evaluation into a unified access-decision mechanism.The proposed framework aims to enable adaptive access control, minimize unauthorized access and lateral movement, and strengthen security across cloud, hybrid, and distributed environments.