What makes trust boundaries a challenging concept?

Perhaps we should start simply, what is the definition of a trust boundary? What exactly do we mean by that?

I usually say it’s where some level of trust stops.  What that “trust” actually is, depends on the context. e.g. Two endpoints trust each other (to some extent) because they are on the same domain etc.  

Personal opinion? It’s a hard concept because we don’t have examples that reflect non-technology concepts. Instead, I think how trust boundaries are introduced is important. To that end - what’s the simplest definition of Trust? Ilike the recent Zero Trust movement, because it’s given rise to context that helps me understand trust. In specific, I like this definition:

[ZTA] is implemented by establishing strong identity verification, validating device compliance prior to granting access, and ensuring least privilege access to only explicitly authorized resources.

By this logic, a “trust boundary” is where:

1. identity has the potential to change needs to be verified
2. ownership and administration of resources change teams or permissions
   or
3. policy and access controls affect explicit actions

The first two can be easy to represent on a DFD, but the last one is made difficult without an understanding of RBAC on a whole, roles & policies and how they relate to group memberships, AND the potential different applications of those concepts in different systemic contexts.

To illustrate, I love asking for 4 workflows;

• What is your user workflow? This is usually the most restrictive, and is the “happy path”.
• What is your administrator workflow? This usually is your operational response workflow, as well as deployment methodologies and systems. Here, you have MORE tools.
• Do those tools relate to users from the previous workflow? If not, what are the differences? Is that new system coordinated across all the products and services?
• What are your external interactor workflows? How do they differ from the above two?

By challenging participants to define identity, ownership, and policy - you build the concept of trust within people. To your point @adamshostack - Trust relies an understanding of an abstract concept.

Given the new push for zero  trust threat modeling, I wonder if the trust boundaries would start to align with the Policy enforcement points and policy decision points by default. 

Generally though, I don’t think organizations struggle with trust boundaries, but I do see that almost every organization uses them differently. I think achieving concept parity within an organization is most important.