Trust is the willingness to rely on a person or entity to act for or protect one’s interests despite vulnerability to its actions. It is relational: reliance carries the risk of error, deception, neglect, or bad intent. Trust is not simply present or absent; it varies with how much vulnerability remains. section 2.6.1
Confidence differs from trust. Confidence rests on evidence and firsthand observation, reducing the vulnerability that must be accepted. A traveler may have confidence in aviation safety evidence while trusting airlines, regulators, pilots, mechanics, and controllers to perform their roles. Increasing confidence can reduce—but not eliminate—the need for trust. section 2.6.1
In digital identity, users and operators must decide what confidence signals justify reliance. They may ask whether an account is compromised, an identity-provider attribute is verified, a site is genuine, a role has appropriate access, or one account can reach another. Poor signals can create false confidence: phishing succeeds when people rely on deceptive links, texts, or emails. section 2.6.2
Build confidence where technology can provide evidence, but treat trust as a governance problem where it cannot:
- Use authentication, cryptography, software controls, and policy enforcement to establish measurable technical confidence in identity validity and decisions. section 2.6.4
- Govern issuer authority before accepting external claims: genuineness and integrity of a credential do not establish that its issuer is qualified for a claim. section 16.3
- Maintain governance processes that vet, supervise, and hold issuers accountable, including rules for accreditation, renewal, suspension, and revocation. section 16.3
- Use social norms and formal governance to address fairness, accountability, compliance, cost, and user experience when technical controls cannot settle them. section 2.6.4
Table 2.2 A comparison of technical confidence and trust
| Aspect |
Technical confidence |
Trust |
|---|---|---|
| Foundation |
Cryptography, software, authentication, policies |
Governance, oversight, social norms |
| Scope |
Ensures identity validity and policy enforcement |
Ensures policies are fair, accountable, and correct |
| Strengths |
Objective, measurable, scalable—identity verification and enforcement can be automated with high reliability. |
Flexible, adaptable, and responsive to human concerns—allows for policy exceptions, ethical oversight, and judgment |
| Weaknesses |
Can be circumvented by insider threats, weak policies, or social engineering |
Can be subjective, slow, and prone to human error |
Compare technical confidence with trust: automated controls can validate and enforce, while governance and oversight judge whether rules are fair, accountable, and correct. section 2.6.4
Trusting a credential issuer
A verifier can confirm cryptographically that a security-auditor credential is genuine and unaltered. Before using it in authorization, the verifier must still determine whether the issuer is accredited and trusted to make that claim. A governance authority supplies the framework for evaluating, supervising, and holding issuers accountable; trust belongs in that authority and its rules, not in the credential holder. section 16.3
Trust cannot be solved entirely by better identity technology. Even a perfect system cannot prevent malicious or incompetent insiders who legitimately need access, nor can it determine whether an apparently enforced policy reflects management intent or regulatory requirements. Technical controls and policies therefore need governance, review, and accountability around them. section 2.6.4
Network location is also an unreliable trust signal. Perimeter security once implicitly trusted activity inside a corporate network, enabling lateral movement after an attacker gained access. Cloud services, remote work, SaaS applications, contractors, and external collaborators dissolve that boundary. Zero trust responds by rejecting location-based implicit trust rather than treating it as proof of identity or authorization. section 15.1
At organizational scale, trust is supported by explicit, observable authority boundaries. Shared policy infrastructure, reliable signals, governed policies, and visible decisions let teams delegate and automate while retaining control and explaining challenged decisions. For autonomous agents, decisions must be evaluated continuously, delegation must be explicit and bounded, and trust must be enforced by policy rather than inferred from static configuration. section 19.4 section 19.7
