When a user says:

Zero Trust is down.

that is a symptom, not a diagnosis.

A modern access path may depend on several control planes:

Identity
   ↓
Device posture
   ↓
Access policy
   ↓
DNS / secure web controls
   ↓
Private tunnel / routing
   ↓
Origin application

A failure in any one of them can look similar from the user’s perspective.

My preferred first question is therefore:

Which control point actually failed?

Useful checks include:

  • Can the user authenticate?
  • Are expected identity claims/groups present?
  • Is device posture healthy?
  • Is the policy matching the expected rule?
  • Does DNS resolve correctly?
  • Is the client connected?
  • Are private connectors/tunnels healthy?
  • Can the origin itself be reached?

The reason this matters is that a broad bypass may restore access while disabling controls that were never broken.

The narrowest fix is usually the safer fix.