The physical world is full of zero trust examples, but they gather attributes for the access control decisions in a very different way than we're used to online.