Where the policy enforcement point sits on an endpoint

Most Zero Trust diagrams show a tidy arrow between a subject and a resource, with “PEP” hovering somewhere in the middle. That picture is accurate and useless at the same time. It does not tell you where the PEP actually runs, what it can see, or what happens when the connection it depends on goes down.

On a managed endpoint, the answers to those questions determine whether your Zero Trust architecture holds under pressure or looks good only on paper.

The two logical components

NIST SP 800-207 separates trust evaluation into two jobs:

• Policy Decision Point (PDP): the brain. It takes in trust signals - certificates, behaviour patterns, network context, session history, device posture - and returns a verdict on each subject.
• Policy Enforcement Point (PEP): the lock. It receives the PDP’s verdict and enforces it at the point where a subject tries to reach a resource.

The split is deliberate. The PDP needs visibility across all subjects to reason about trust consistently. The PEP needs to be close to what it is protecting so the enforcement is hard to bypass.

On a server guarding a database, the PEP is easy to place - it sits in front of the API gateway. On an endpoint, placement is less obvious, because the endpoint itself is both the subject and the thing being protected.

Where the PEP lives on an endpoint

On a managed endpoint, the PEP lives inside the agent.

The agent sits between the kernel and everything that tries to leave or enter the device. It observes process behaviour, network traffic patterns, file system events and authentication activity. It packages those observations as trust signals, sends them to the PDP on the triage server, and receives back a trust level.

On LightEDR, that trust level is one of four values: FULL, REDUCED, QUARANTINE, or DENIED. It is not a label - it is the agent’s operating state, and it determines what the endpoint can reach.

[endpoint]
  agent (PEP)
    |
    +--> trust signals  --->  triage server (PDP)
    <-- trust level     <---
    |
    v
  enforcement
  FULL / REDUCED / QUARANTINE / DENIED

At FULL, normal operation. At REDUCED, access to sensitive lateral resources is blocked. At QUARANTINE, the endpoint is network-isolated - it can still reach the triage server to report status, but lateral movement is cut. At DENIED, connection refused.

This differs from a firewall rule, which evaluates a packet on its headers alone. The PEP evaluates a subject on a continuously updated picture of its behaviour. The certificate that the endpoint presents covers 35% of the trust score; behaviour patterns cover another 30%. A certificate that is technically valid but attached to a host scanning internal subnets will not hold FULL trust.

One design requirement that follows from this: the channel between PEP and PDP must fail closed. If the agent cannot reach the triage server, the safe default is to operate as if trust has dropped - not to assume everything is fine because the PDP was unreachable. Fail-open on connectivity loss is not Zero Trust in any meaningful sense.

What happens when the decision changes

Zero Trust means continuous verification, not a one-time gate at login. The trust level moves as signals change.

When the PDP receives new signals that reduce confidence in a host - unusual process lineage, a new external connection destination, an integrity check failure - it recalculates. The PEP enforces the updated level immediately. No ticket, no approval cycle, no refresh delay.

This is the architectural gap that most legacy EDR does not cover. Detection fires after an event. The PEP acts before the next one.

For a SOC team, the practical effect is that containment is a structural property of the network rather than a manual step taken after an alert. By the time an analyst reviews a finding, the endpoint’s access has already been scoped to its current trust level. The analyst confirms the situation and adjusts policy where needed - rather than racing the attacker to prevent the next hop.

Getting that posture right means calibrating the thresholds: understanding what REDUCED looks like in your environment, when QUARANTINE is the correct response, and whether your signal weights reflect the threats you actually face. The PEP placement is fixed. The policy is what you tune.

To see how LightEDR handles PEP placement and trust level transitions in practice, visit the product page or get in touch.