Managing that at scale is so unbelievably hard. Network layer stuff like VPN tends to be really isolated from application access restrictions both in terms of data and operational processes, so you end up having to duplicate the access controls and it's never in sync. Ask me how I know; I've been trying for years.

Something like Google's BeyondCorp where the access restrictions are done in a proxy or other application layer is much more likely to be tied to the same access controls used within applications. That way ZTA acts as an additional security boundary but not an entirely separate authentication and authorization system that VPNs tend to be.

true, VPNs can be a ZTA building block when coupled with identity-aware policy (Tailscale et al)

I think when most think VPNs though they're talking enterprise ICT VPNs that historically don't play in that space :(

I suppose you could start at a really coarse level; it's pretty easy to have the VPN read the user's group from some central source and use that to decide what subnet(s) they get, and then you put ex. internal-use servers (say, file shares) on one subnet, customer application servers on another, and LOM consoles on a third.

Isn’t that just ZTA but inside the VPN or do you mean still using the appliance to gate access?

The point of ZTA, the idea of strong per-application RBAC, is that if you do it right, VPNs are useless.

To need a VPN for "defense-in-depth" is to admit you don't have or want ZTA within parts of your perimeter. And that isn't a bad thing! ZTA is really hard to do unless you're building your business and all its core apps from scratch.

Would that be something like HashiCorp's Boundary[1] ?

[1] https://www.boundaryproject.io/