Zero Trust Architecture

Authenticate and authorize every request, even inside the private network.

security

Detailed Description

Zero trust treats network location as insufficient proof of safety.

Every service call should carry identity and be checked against policy.

Visual Diagram

Zero Trust per request
  Old model: inside network = trusted
  ServiceA calls ServiceB → just works

  Zero Trust model: verify everything
  ServiceA calls ServiceB
    → present identity (mTLS cert / JWT)
    → B verifies identity
    → B checks authorization policy
    → B logs the access
    → allow or deny

Tradeoffs

Pros

Reduces blast radius and implicit trust

Cons

Requires identity, policy, and tooling maturity

Examples: BeyondCorp, SPIFFE/SPIRE, Istio AuthorizationPolicy