Never trust, always verify, applied to every request, every session, every device. Operationally hard, conceptually simple.