This statement is false. In an enterprise Zero Trust architecture, identifying and proving the identity of an initiating entity (the "who") is the function of the organization's Identity and Access Management (IAM) solution, specifically the Identity Provider (IdP). The IdP (e.g., Azure AD, Okta, Ping Identity) is responsible for authenticating users and asserting their identity to the Zero Trust policy enforcement point. Government agencies issue legal identities but are not involved in authenticating real-time access requests to corporate resources.

This is a True/False style question. The statement is factually incorrect within the context of enterprise cybersecurity and Zero Trust principles.

1. Zscaler. (2023). Zscaler Zero Trust Certified Architect (ZTCA) Study Guide. Module 2: The Zero Trust Model, Section: "Core Components of Zero Trust," Sub-section: "Identity." This section explicitly states that the "who" is determined by the enterprise's identity provider (IdP), which manages user identities and authentication.