Techniques for onboarding web applications in a zero trust environment

A non-transitory computer readable medium comprising instructions that upon execution cause a system to:

• receive a request from an authorizing user device to initiate a network session with a zero trust environment, the request including a login credential corresponding to an authorizing user account;
• record an interaction between the authorizing user device and a resource external to the zero trust environment, the interaction based on an access request of the authorizing user device to access the resource;
• detect a domain associated with the resource accessed by the authorizing user device;
• generate a policy based on the recording of the interaction, the policy comprising a rule specifying a condition under which a designated user account different from the authorizing user account is permitted access to the domain;
• and
• use, by a policy engine, the policy to determine whether to grant a designated user device associated with the designated user account access to the domain in response to a request from the designated user device, wherein the designated user account is assigned a privilege from the authorizing user device, the privilege allowing the designated user account to generate the request from the designated user device.

A system for a zero trust environment, comprising:

• processing circuitry;
• and
• a non-transitory storage medium storing instructions executable by the processing circuitry to:
• receive a request from an authorizing user device to initiate a network session with the zero trust environment, the request including a login credential corresponding to an authorizing user account;
• record an interaction between the authorizing user device and a resource external to the zero trust environment, the interaction based on an access request of the authorizing user device to access the resource;
• detect a domain associated with the resource accessed by the authorizing user device;
• generate a policy based on the recording of the interaction, the policy comprising a rule specifying a condition under which a designated user account different from the authorizing user account is permitted access to the domain;
• and
• use, by a policy engine, the policy to determine whether to grant a designated user device associated with the designated user account access to the domain in response to a request from the designated user device, wherein the designated user account is assigned a privilege from the authorizing user device, the privilege allowing the designated user account to generate the request from the designated user device.