Most "ZTA" is a checklist item. A vendor bolts token verification onto an existing stack, calls it Zero Trust, ships it. Technically true. Practically thin. The verification is real, but the system underneath still assumes it will stay up, stay put, and never need to be rebuilt from scratch.

That assumption is the actual gap. NIST 800-207 tells you how to verify. It doesn't tell you what your infrastructure has to survive.

We built DATPAQ around four properties instead. Not as theory. As constraints we hit in production.

1. Scalable

Every service scales independently based on load, not based on a capacity plan someone wrote three months ago. No manual intervention, no war room when traffic spikes.

Agents don't request access once and sit idle. They call constantly, in bursts, from everywhere. A ZTA that can't scale under agent-native traffic patterns isn't ready for agents. It's ready for the traffic humans generate, which is a different problem.

2. Portable

Most Zero Trust gets quietly welded to wherever it was first deployed. Move it, and the guarantees get shakier.

Ours doesn't care where it runs. Same trust, same posture, anywhere it lands. That's not a convenience feature. It's a requirement, once you accept that agents and workloads move constantly and shouldn't have to renegotiate safety every time they do.

3. Disposable

This is the pillar nobody wants to build. If a piece of infrastructure can't be killed without ceremony, it isn't Zero Trust. It's a pet you're protecting.

We can take any piece of this system down, on purpose, without warning, and nothing breaks that shouldn't. That's a design decision, not an accident, and it's a much harder thing to build than uptime.

4. Recoverable

Disposable without recoverable is just an outage. The two have to travel together. Coming back has to be boring. No special incident mode, no manual choreography, no tribal knowledge required to bring it back to life.

If recovery looks different from a normal deploy, that's a sign trust was never actually distributed the way it needed to be.

Why this matters for agents specifically

A human logs in once and works for eight hours. An agent authenticates constantly, spins up and down, retries, fails, restarts, and does it again a thousand times a day without a person in the loop to notice if something's off.

That environment punishes anything that isn't scalable, portable, disposable, and recoverable. Static infrastructure with Zero Trust bolted on survives human traffic patterns. It doesn't survive agent traffic patterns.

We didn't build these four pillars because a framework told us to. We built them because we assumed, from day one, that every part of the system would eventually fail, move, or need to be torn down and stood back up. That assumption, not any single technical trick, is what makes this Zero Trust in practice and not just on paper.

The four pillars are what makes that survivable at agent scale instead of collapsing under it.

That's the difference between ZTA as a compliance checkbox and ZTA as the thing your architecture actually is.