A zero trust policy is based on the principle of least privilege. Only grant access to the information or permissions that each employee needs for their role in the organization.