Trust Zone and TFM - what is it how does it work?

I would like to understand what TrustedFirmware-M is with an emphasis on how it works with an emphasis on the Zephyr operating system. I read the official documentation but everything is described there like on an advertising brochure. I don’t want to see another drawing that there are secure and non-secure blocks. I really want to understand how it works when using a board with /ns. What I really give is CONFIG_BUILD_WITH_TFM=y.