Web application firewallZero Trust
Access policies
Allow or deny application access by email, domain, or provider account.
Policy setup
- Open the application.
- Select Add policy.
- Select Allow or Deny.
- Enter the identities, one value per line.
- Select Save Zero Trust.
Selectors
| Selector | Example | Match |
|---|---|---|
| Verified email | admin@example.com | That exact address |
| Verified domain | example.com | Verified addresses in that exact domain |
| Provider subject | company:immutable-user-42 | That user under provider company |
A policy matches when any of its selectors matches. A domain selector covers only that exact domain, not its subdomains. Subject rules use the provider ID shown in the provider editor.
Decisions
- A matching deny policy overrides every allow policy.
- No matching allow policy means denial.
- Email rules require a provider-verified email.
- Only assigned providers can authenticate to the application.
Email code visitors see the same code form when their address is denied. The denial appears in Access activity.