8 August 2026

Zero Trust Troubleshooting: Find the Failed Control Plane First

Before creating an emergency bypass, work out whether the failure is identity, posture, policy, DNS, tunnel or origin.

When a user says:

Zero Trust is down.

that is a symptom, not a diagnosis.

A modern access path may depend on several control planes:

Identity
   ↓
Device posture
   ↓
Access policy
   ↓
DNS / secure web controls
   ↓
Private tunnel / routing
   ↓
Origin application

A failure in any one of them can look similar from the user’s perspective.

My preferred first question is therefore:

Which control point actually failed?

Useful checks include:

• Can the user authenticate?
• Are expected identity claims/groups present?
• Is device posture healthy?
• Is the policy matching the expected rule?
• Does DNS resolve correctly?
• Is the client connected?
• Are private connectors/tunnels healthy?
• Can the origin itself be reached?

The reason this matters is that a broad bypass may restore access while disabling controls that were never broken.

The narrowest fix is usually the safer fix.