Zero-Trust Policies

In the mesh, being inside is not the same as being trusted. Access is granted by identity, posture, and explicit policy — network location alone buys nothing.

Identity first, location never

Every agent holds certificates issued from the MeshCA and a node identity bound to the mesh. When a peer asks for access, the coordinator checks who it is, what posture it reports, and what policy grants — not which subnet it happens to sit in. The packet path enforces this at every hop: the receiving agent validates the source identity, decrypts, and checks replay state before injecting a single byte.

Least privilege, outward

Write policy from least privilege outward. Work through the roles in your environment one at a time:

Operators — the narrow set of control-plane calls their actual job requires.
Services — only the peers and methods a workload needs to function.
Build systems and Git runners — read what they build, write only what they publish.
Routers and public ingress — the exact surfaces they terminate, nothing more.

Each role receives access to only the resources it needs — and each grant is a policy line someone can read, review, and revoke.

Authorization surfaces

The coordinator enforces authorization across RBAC, setup keys, node tokens, and method-level permissions. Setup keys gate who may join the mesh at all; node tokens identify enrolled agents; RBAC and method-level permissions govern what each identity may do once inside.

Representative ACL shape

  teams:
    operations: [op-1, op-2]
    builders:   [runner-a, runner-b]

  grants:
    - team: operations
      access: coordinator /v1/nodes read, /v1/acls write
    - team: builders
      access: git node read, publish artifact to registry
    - node: runner-b
      access: git node write (branch: main only)

  firewall:
    - source: operations
      destination: control plane
      allow: [management, telemetry]

Policy lifecycle

The coordinator compiles ACLs, teams, groups, and firewall rules into the posture agents actually apply, and syncs that posture through the enrollment heartbeat. Policy changes propagate the same way — no manual rule editing on nodes, no drift between "what we decided" and "what the mesh enforces."

Policy is evidence, too. Every policy change is an auditable event. The audit model records who changed policy, which node or service was affected, and whether the change came from a human operator or an automation token.

Previous Post-Quantum Key Policy Next Audit & Logging