Why architecture matters here
Perimeter defense fails catastrophically. One compromised laptop inside the VPN pivots to production databases. The architecture matters because zero trust breaks the implicit trust chain: even inside the network, every request must prove itself.
Getting it right does not happen overnight. You need identity + device posture signals, a policy engine that can decide fast, enforcement points close to workloads, and telemetry that feeds risk scoring. Each piece is a project.
Understanding the pieces lets you sequence the migration: identity first, then enforcement, then micro-segmentation, then continuous verification and just-in-time access. Skip a step and the deployment stalls.
The architecture: every piece explained
The top strip is the verification path. User + device presents identity and posture (patch level, disk encryption, MDM compliance). Identity provider — SSO + MFA + risk-based auth — issues short-lived tokens. Policy engine evaluates OPA/Cedar rules against the request context. Policy enforcement is at sidecar proxies, API gateways, or SSH bastions — every request funnels through one.
The middle row is the network layer. Micro-segmentation partitions workloads with per-service policy. mTLS + SPIFFE gives every workload a verifiable identity for machine-to-machine auth. Continuous verify re-evaluates policy on every request or short-lived session; not once at login. Session risk triggers step-up auth when signals change (new geolocation, unusual pattern).
The lower rows are the lifecycle. Telemetry + SIEM feeds risk signals back into the policy engine. Just-in-time access replaces standing grants with time-bounded, approval-gated access. Governance keeps policy in git, audits access grants, and detects drift.
End-to-end flow
End-to-end: an engineer needs to view a production log. She authenticates via SSO with MFA; risk score is normal. Device posture check confirms disk encryption and current patch level. She requests access via JIT tool; approval workflow grants her the role for 30 minutes. Her requests to the log service go through a sidecar proxy that re-verifies identity and context on every call. Meanwhile a workload service uses its SPIFFE identity to fetch a secret; mTLS enforces the workload identity; policy allows only that specific secret. Telemetry streams into SIEM. If her behavior looked anomalous mid-session, the risk score would rise and step-up auth would trigger.