https://zerotrustmachines.com/ Essays on zero trust architecture: identity as the control plane, policy enforcement and decision points, microsegmentation in practice, device posture, workload identity and mutual TLS, and the honest limits of the model. en https://zerotrustmachines.com/what-zero-trust-does-not-fix/ https://zerotrustmachines.com/what-zero-trust-does-not-fix/ Thu, 30 Jul 2026 00:00:00 +0000 Limits The model relocates trust rather than eliminating it. Knowing precisely where it was relocated to — the issuer, the policy, the enforcement points, the administrators — is the difference between architecture and belief. https://zerotrustmachines.com/workload-identity-without-shared-secrets/ https://zerotrustmachines.com/workload-identity-without-shared-secrets/ Sat, 18 Jul 2026 00:00:00 +0000 Workloads Service-to-service authentication is where most estates still run on long-lived credentials that nobody can rotate. Replacing them means giving workloads identities they cannot copy and did not have to be told. https://zerotrustmachines.com/device-posture-and-the-cost-of-checking-again/ https://zerotrustmachines.com/device-posture-and-the-cost-of-checking-again/ Mon, 06 Jul 2026 00:00:00 +0000 Device Signals Posture is a claim made by software running on the machine being assessed. Re-checking it continuously is the expensive part of zero trust, and the expense is where most implementations quietly compromise. https://zerotrustmachines.com/microsegmentation-in-production/ https://zerotrustmachines.com/microsegmentation-in-production/ Tue, 23 Jun 2026 00:00:00 +0000 Segmentation Segmentation is easy to draw and hard to keep. The difficulty is never the enforcement technology — it is that nobody has an accurate description of which systems legitimately talk to which. https://zerotrustmachines.com/identity-as-the-control-plane/ https://zerotrustmachines.com/identity-as-the-control-plane/ Thu, 11 Jun 2026 00:00:00 +0000 Identity If policy is written against identity, then the identity system is not one control among many — it is where authority is manufactured, and the estate inherits every weakness it has. https://zerotrustmachines.com/what-the-perimeter-was-actually-for/ https://zerotrustmachines.com/what-the-perimeter-was-actually-for/ Tue, 02 Jun 2026 00:00:00 +0000 Architecture The network perimeter was not a mistake. It was an amortisation strategy for the cost of authorisation, and it worked until network location stopped predicting anything useful about the requester.