NIST SP 800-207 defines Zero Trust Architecture around one core tenet: no implicit trust is ever granted based on network location. A Policy Decision Point (PDP) computes a trust score for every access request from live signals, and a Policy Enforcement Point (PEP) allows or denies traffic continuously, not just once at the network edge. This 2D scope renders that math directly: instead of watching tokens fly through 3D space, you watch each request's actual trust(t) curve trace out on an oscilloscope, exactly the way a security operations dashboard would plot it.
trust(t) = [ wd·health + wl·(1 − locationRisk) + wb·(1 − anomaly(t)) ] · e^(−λt)
access granted ⇔ trust(t) ≥ τ — evaluated at EVERY instant t
wd=0.40 wl=0.35 wb=0.25 (device posture, network context, behavior)
threshold-crossing time (no anomaly yet): t* = ln(base / τ) / λ
Each trace starts at the left edge (spawn, t=0) with a base score drawn from that session's device-health and location-risk, then decays exponentially — a credential established further in the past is inherently less trustworthy, even with no new evidence. A dice roll partway through a session's flight can trigger an anomalous-behavior event, which shows up on the scope as an instantaneous downward step in the curve (verified numerically: the step size equals exactly wb·penalty·e^(−λ·t_anomaly)).
- Zero Trust mode — the PDP re-reads each curve continuously against the dashed threshold line. A curve that dips below it after the gate triggers live revocation (turns red) even after admission.
- Perimeter mode — trust is sampled once, at t=0 (the curve's starting height), before the request even starts. If that single sample clears τ, nothing the curve does afterward — decay, an anomaly step — is re-checked, exactly like a VPN/firewall perimeter that trusts anyone already inside.
- Trust threshold τ — the PDP's minimum acceptable score; raising it enforces stricter least-privilege access and pushes the threshold line up the scope.
- Decay rate λ and anomaly rate — how steeply curves fall and how often a session shows a downward step mid-flight.
Real-world relevance: this request-time evaluation loop mirrors production Zero Trust systems (Google BeyondCorp, Microsoft Conditional Access, service-mesh mTLS policy engines) — the score, weights and thresholds differ, but "never trust, always verify, at every request" is the shared mechanism.