A security architect is redesigning a corporate network after a breach where an attacker used stolen VPN credentials to move freely across internal systems once inside the perimeter. The architect wants a model where no user or device is trusted by default, every access request is authenticated and authorized regardless of location, and users receive only the minimum access needed for their role. Which security concept best describes this approach?