Reference architecture
Zero Trust access
Identity, not network location, decides access: SSO with MFA, an identity-aware edge, and least-privilege policies per service.
Zero Trust access
01
User
- Device
- Browser / CLI
02
Identity
- Okta SSO
- MFA
03
Edge
- Cloudflare Zero Trust
- WAF
04
Policy
- Per-app rules
- Least privilege
05
Services
- Internal apps
- Clusters
Assurance plane
Audit logs · Session limits · Continuous verification
Design decisions
DECISION 1
No implicit trust from being 'inside' the network.
DECISION 2
Access is granted per application, per identity, and reviewed.
DECISION 3
Built on enterprise identity work with an Okta Apex Partner.
Components
- User
- Device · Browser / CLI
- Identity
- Okta SSO · MFA
- Edge
- Cloudflare Zero Trust · WAF
- Policy
- Per-app rules · Least privilege
- Services
- Internal apps · Clusters