Zero-Trust Octagon — a framework from first principles

The term has been stretched so far that it now covers almost any access product. In the book’s archetype model, none of the three non-aspirational deployments fully satisfies more than two of the eight axioms. Three category errors dominate.

Zero trust is not ZTNA. ZTNA products, identity-aware proxies, and software-defined perimeters are an enforcement mechanism: one value on one dimension of the matrix. A ZTNA product mediates access to self-hosted applications. It does nothing for the SaaS platforms your users reach through SSO, nothing for pod-to-pod traffic inside a Kubernetes cluster, and nothing to verify that the data your SIEM ingests is untampered.

Zero trust is not a compliance framework. NIST SP 800-207 provides the conceptual model in the seven tenets of its section 2.1: every data source and service is a resource, network location confers no trust and all communication is secured regardless of it, access is granted per session and set by dynamic policy, and the enterprise monitors asset posture and collects as much information as it can to improve its decisions. CISA’s ZTMM 2.0 operationalizes that across five pillars (Identity, Devices, Networks, Applications and Workloads, Data) and four stages (Traditional, Initial, Advanced, Optimal), with three cross-cutting capabilities. But compliance frameworks optimize for auditability, not adversarial resilience: a system can pass a SOC 2 audit and satisfy none of the Octagon’s axioms, with documented policies that are vendor black boxes (violating Axiom 2) and comprehensive logging that is implicitly trusted (violating Axiom 7).

Zero trust is not a product suite. Vendors provide tools that implement values on individual dimensions. The architecture is the set of choices you make across all dimensions and how those choices interact. Worse, a single-vendor suite often violates Axiom 6 by construction: the vendor becomes the single component whose compromise collapses everything. This is not an argument against vendors. It is an argument against mistaking a product’s scope for your threat model.

The regulatory push is real. Executive Order 14028 (May 2021) set the policy to "advance toward Zero Trust Architecture" (sec. 3(a)) and required each agency to plan for it (sec. 3(b)(ii)); OMB M-22-09 (January 2022) set the federal strategy and deadlines. The DoD Zero Trust Strategy (2022) and its execution roadmap went further, with 152 activities across seven pillars (91 target-level, 61 advanced; target level due by FY2027). NIST’s own SP 1800-35 (final, June 2025) documents 19 example zero trust builds assembled with 24 industry collaborators, the closest thing to public evidence of how real implementations are put together, and the NSA’s Zero Trust Implementation Guidelines (January 2026) are explicitly modular rather than a single ladder.

For readers in the EU the binding regime is different. NIS2 Article 21 and its Implementing Regulation (EU) 2024/2690 require risk-management measures, including access control, asset management and multi-factor authentication, and ENISA’s technical implementation guidance (June 2025) maps them to evidence. None of them uses the words "zero trust", but most of the axioms below land on those measures, and an Octagon audit can be reused as NIS2 evidence.

An axiom is a statement accepted as true, from which everything else is derived. The Octagon asks what must be true about any system that claims to distrust by default, verify continuously, and survive the compromise of its own components. The answer, after stripping away vendor names and implementation patterns, is eight invariants:

1. No intrinsic trust. Trust is a transient verdict rendered independently for each access decision, based on the entity’s current provable state. Not a property of position, ownership, or history. Trust decays continuously, and the system must be able to deny an entity that was trusted one second ago.

2. Explicit, verifiable policy. Every decision evaluates against a machine-enforceable, deterministic policy that a neutral third party can replay. A policy that cannot be re-executed by an independent evaluator with identical inputs cannot be checked by anyone. "Allow all" and "deny all" are degenerate, because they bypass the decision model.

3. Unbypassable mediation. There is no physical or logical path to any resource that does not invoke the evaluation function. This axiom was first drafted as "separate the policy decision point from the policy enforcement point" and revised during the book’s drafting, because that is an implementation pattern: cryptographic data envelopes fuse the two and still satisfy the invariant. The requirement is not who enforces, but whether enforcement is escapable. Break-glass, emergency override, and physical console access are all mediation paths.

4. Continuous verification. Verdicts expire. Re-verification happens at a cadence driven by risk, bounded by the fastest compromise-to-exploitation timeline in your threat model. "Continuous" does not mean constant; it means risk-calibrated and fresh before an action completes. A system that verifies once at login and trusts the session for 12 hours is a traditional system with a strong front door.

5. Deterministic bounded authority. Every grant of access confers a mathematically bounded vector of state transitions, calculable before authorization. Authority cannot expand without a new independent decision. "Admin" is an anti-pattern not because it is broad but because it is unbounded: nobody can calculate what it can do.

6. Byzantine fault tolerance. The architecture keeps its structural and epistemic integrity even when components act maliciously or arbitrarily. A compromised PEP cannot alter policy. A compromised log agent cannot erase history. This axiom replaced "assume breach," which is a mindset, not an invariant.

7. Epistemic integrity. State inputs to the evaluation function must carry cryptographic proof of provenance. Unattested data is hostile input, usable to deny but never to grant. This axiom was missing from the first draft and was added while the book was being written. Every non-aspirational archetype in the model fails it.

8. Bilateral symmetry. Trust evaluation is bidirectional. The resource proves its state to the requester before data exchange, and the requester proves its state to the resource. A client that sends protected data to a server it has not verified is trusting the server intrinsically, which violates Axiom 1. mTLS is the minimum form, not the whole requirement.

The axioms were not born fully formed. Axioms 3, 5, and 6 were refined from weaker first drafts, and 7 and 8 were added when the set proved incomplete. The book claims the eight are individually necessary and collectively sufficient. Treat that as a design claim, not a proof: the set grew from five to eight while it was being written, and Section 8 lists five candidate extensions. What the report relies on is the weaker claim that each axiom is necessary. Fail one and the architecture is not zero trust, regardless of how many products are bolted on.

Three properties separate meaningful zero trust from the performative kind. The architecture must survive its own defense mechanisms: when the policy engine makes a mistake, the business should not pay. Observability must be independently verifiable: if you believe the SIEM because it is the SIEM, an attacker with enough privilege can blind, poison, or fabricate logs. And the architecture must be falsifiable: replayable policies and verifiable attestation chains are testable artifacts, not articles of faith.

The second piece of the framework is a morphological matrix, the method Fritz Zwicky developed in the 1940s and Tom Ritchey later formalized as General Morphological Analysis. It has nine architectural dimensions, each with a range of concrete values ordered from least to most mature. Every deployment maps to one value per dimension. The canonical values, shared with the companion matrix page:

D1 trust anchor: software CA, behavioural, hybrid hierarchical, silicon root of trust, distributed multi-party. D2 identity model: static just-in-time tokens, attribute-based, delegated capabilities, trust decay, probationary identity, zero standing privileges. D3 enforcement layer: network perimeter, service mesh, application or gateway, data (cryptographic envelopes), silicon or hypervisor, bilateral. D4 attestation modality: none (the book calls it trust on first use), single source, behavioural, cascading, continuous, heterogeneous triple. D5 violation response: hard deny, graceful degradation, micro-friction, auto-escalation to a human, static honeypot, trickle-truth.

D6 policy distribution: scheduled push, just-in-time pull, GitOps sync, policy embedded in the data, bilateral consensus on the policy version, event-streamed. D7 observability trust: implicit, sequence-verified ingestion, dual pipeline, Merkle-attested telemetry, heterogeneous observer consensus. D8 organizational posture: siloed, fused, economic-contract, presumptively wrong, dojo-trained. D9 human continuity: single point of failure, small rotation, 24/7 SOC, fully automated.

The matrix replaces the maturity model. A maturity model assumes one path. The matrix is a configuration space: the values above give nearly 3.9 million combinations. Most of them are incoherent, because some values only work with others: trickle-truth needs event-streamed policy, and auto-escalation to a human is only as good as D9. This is Ritchey’s cross-consistency step, and the book applies it informally. Its judgement is that about a dozen configurations are coherent and defensible, but it does not publish the full pairwise analysis. The dimensions are not independent. They form two self-reinforcing clusters.

The low-maturity cluster: software CA, single-source attestation, push policy, hard deny, implicit observability, siloed organization. These reinforce each other downward. Upgrading one in isolation produces diminishing returns because the others constrain it. A company that upgrades to behavioral attestation while keeping push policy and hard deny will detect more anomalies but respond too slowly, and the response will cascade.

The high-maturity cluster: silicon anchor, heterogeneous attestation, event-streamed policy, trickle-truth response, heterogeneous observer consensus, presumptively-wrong organization. Each value enables the next. Silicon provides the provenance that attestation feeds on; attestation provides the signal quality that trickle-truth decisions need; event-streamed distribution provides the latency trickle-truth requires.

The practical consequence, in the book’s analysis, is that the most common mistake in applying the matrix is mix-and-match upgrading, one dimension at a time, which produces frustration and then abandonment. The dimensions are coupled, so the upgrade has to be planned across them.

Turning the axioms into an eight-question audit and running it against four archetypal deployments produces a consistent pattern. The archetypes are composites built for the book, not audited organizations, so what follows are model outputs. The four: A, the aspirational "Holy Grail" (silicon roots, bilateral enforcement, heterogeneous attestation, trickle-truth); B, the Fortune 500 with a multi-million-dollar vendor suite; C, the hyper-growth startup shipping via GitOps and CI/CD; D, the solo operator gluing SaaS together on a lean budget.

The violation matrix scores each axiom green (pass), yellow (partial) or red (fail); only green counts as satisfied. A passes all eight. B fails all eight: seven outright (Axioms 1, 2, 3, 4, 6, 7, 8) and one partially (Axiom 5: attribute-based grants are scoped but not calculable, and the stolen session could create a service account). Axiom 1 fails because the database trusts anything on the VPN subnet, Axiom 8 because the resource never proves its state to the requester. C passes one (Axiom 2, because GitOps makes policy replayable), fails five outright (Axioms 4, 5, 6, 7, 8) and two partially (Axioms 1 and 3; 1 because pods authenticate with ServiceAccount tokens but share one cluster network, 3 because the gateway mediates but nothing does pod to pod). D passes two (Axioms 1 and 5; 1 because the identity-aware proxy demands identity before any self-hosted app, so network position grants nothing, 5 because the book’s trace finds no grant that exceeds its scope), fails five outright (Axioms 2, 3, 4, 6, 7; 3 because SaaS apps authenticate straight against the identity provider and never pass the proxy) and one partially (Axiom 8: the proxy verifies the client, but the client does not verify the destination). The companion trace pages for B, C and D use the same scores. Three findings from that matrix are worth stating plainly.

First, epistemic integrity (Axiom 7) is a universal failure. Every non-A archetype violates it, including the well-funded one. The reason is structural: satisfying it requires upgrading three dimensions at once (silicon trust anchor, continuous attestation, independently verified observability). It is the most expensive cluster in the matrix, so it is the one everyone skips. The consequence is that policy engines can be correct while their inputs are fabricated.

Second, continuous verification (Axiom 4) is the breach enabler. In the Fortune 500 trace, a stolen session token rides for 12 hours because nothing re-verifies after authentication. In the startup, CI/CD validation is a one-time event: code is scanned once, deployed, and trusted from then on. In the solo-operator case, the identity provider’s default session runs for days (14 days in Google Workspace, a rolling 90-day window in Entra ID), so the attacker’s runway is limited by detection, not by expiry. In every non-A archetype, one verification event gives the attacker a working window.

Third, hard deny, the default violation response, violates Byzantine fault tolerance. The Fortune 500 trace ends with the system locking out the compromised account, and with it the legitimate user and the administrators who could investigate. The defense mechanism becomes a second attack vector. In the author’s experience, organizations that suffer one false-positive lockout of a critical function often roll the controls back; that is an observation, not a measured rate, but it follows from an architecture that is not Byzantine fault tolerant.

Two more findings. Vendor black-box policy engines violate Axiom 2: if a neutral auditor cannot replay your policy and reproduce the verdict, you do not have verifiable policy. And bilateral symmetry (Axiom 8) is cheaper to improve than most: mutual TLS is deployable with existing infrastructure and moves the axiom from red to yellow in every archetype that adopts it.

The industry’s self-assessment sits uneasily next to its breach data. The RSA 2026 ID IQ Report, a vendor survey of 2,120 respondents working in cybersecurity, IAM, IT and other roles, found that 69% of organizations experienced an identity-related breach in the last three years. The same report found that 57% rate their identity-pillar zero-trust maturity as "Advanced" on CISA’s scale (and 7% as "Optimal").

Both numbers are in the same survey. The report does not publish the overlap between the two groups, but set arithmetic alone guarantees that at least a quarter of all respondents rate themselves Advanced and also report a breach. One caveat matters: the breach window is the last three years and the maturity rating is current, so the overlap does not show that anyone was breached while already rated Advanced. What it does show is that a high self-rating and a recent identity breach routinely sit in the same organization. Self-assessments ask whether a capability exists. The eight-question audit asks whether the capability produces a verifiable, bounded, continuous verdict.

The book’s Part III walks each archetype through a full incident timeline. The compressed versions below are constructed scenarios grounded in the incident classes cited in this report, not accounts of specific engagements:

Archetype B, the Fortune 500: stolen token, full breach. An infostealer harvests a valid session. Authentication is bypassed because the session is trusted for the 12 hours the enterprise configured. The policy decision point is a vendor black box that cannot be replayed. Enforcement exists only at the network perimeter, so the attacker moves laterally inside the data center. The SIEM stays silent, and the silence is trusted as evidence of normality, because no independent verification pipeline exists. When the tripwire finally fires, the hard deny cascade locks out the responders. The data is exfiltrated and the business is down. The attack was detected, and the response caused the worse incident.

Archetype C, the startup: a malicious dependency. A package with a lookalike name passes CI/CD, because verification happens once, at build time: if code passes the pipeline, nothing checks it again. The malicious code runs with the full ServiceAccount permissions of the legitimate service, because nothing bounds authority to what the service actually needs. Detection is fast, faster than any other non-aspirational archetype, and it still cannot prevent exfiltration during the degrade window: the attack passed the architecture’s only verification gate, and the malicious code already holds the permissions it needs.

This class of attack is not hypothetical. In August 2025, the s1ngularity supply-chain attack compromised the nx npm package; the Cloud Security Alliance’s note on Mandiant’s UNC6426 findings documents how a token stolen in that breach was used to abuse a GitHub Actions OIDC role trust and reach full AWS administrator access in under 72 hours, an Axiom 5 failure in a single hop. In March 2026, the TeamPCP campaign published backdoored LiteLLM releases to PyPI (1.82.7 and 1.82.8) that harvested credentials and could create privileged pods in Kubernetes clusters; the same campaign also hit Trivy, Telnyx and Checkmarx KICS. In both cases the pattern is the same: trust was assumed at a boundary where verification happened once, and credentials chained upward.

Archetype D, the solo operator: MFA fatigue and the SaaS blind spot. On a plain push setup without number matching, an attacker prompt-bombs MFA until the user accepts, then hits the identity-aware proxy. The IAP works: the finance dashboard is not reached. What the IAP does not protect is the SaaS estate, in the book’s trace Google Workspace, which authenticates directly with the identity provider and is invisible to the proxy. The response depends entirely on whether Pat, the one human, is awake and alert. When Pat is available and alert, the response takes about three minutes. When Pat is asleep, it takes 25 minutes or more, and in practice lasts until Pat wakes. When Pat is available but fatigued, the response is effectively indefinite until the user reports the breach. The distribution has two peaks, and the slow one sets the loss. The trace also notes that Workspace records Drive file-access events only on Enterprise-class and some other higher editions, so a lean tenant may not be able to say what was opened.

Archetype A, the aspirant, passes all eight and costs accordingly. Its defining response is trickle-truth: a detected attacker is served convincing fake data through an adaptive environment, revealing tactics while exfiltrating nothing real. In the model it achieves zero data loss and zero business impact, and it inverts the attacker’s cost model. It also requires silicon roots, heterogeneous attestation, event-streamed policy distribution, and a live deception environment. The book estimates the infrastructure and ML investment at $500K per year or more. Treat it as a definition of the destination, not a recommendation. The book traces A in full; this site does not yet have a separate page for it.

Several cross-cutting findings survived the archetype analysis and are the parts I actually use when reviewing an architecture:

The detect-respond gap matters more than MTTD. Mean time to detect is the metric everyone reports. The gap between detection and effective response is the interval during which the attacker still inflicts damage, and it is the better metric. The Fortune 500 has the worst gap not because detection is slow but because response causes new damage.

The leverage hierarchy is not what vendors sell. Ranked by impact per upgrade: D5 violation response first, then D4 attestation, then D8 organizational posture, then D2 identity model, then D7 observability trust. D1, the trust anchor, is deliberately not in the top five: an attested hardware root whose reports are verified by an implicitly trusted SIEM is not meaningfully more secure than a software root.

D8, organizational posture, is the only dimension that costs zero dollars. Fused security and operations teams, shared incident response, blameless post-mortems. No hardware, no contracts, no licenses. The barrier is political, not financial. The DoD reached a similar conclusion in its own way: it set up a Zero Trust Portfolio Management Office in January 2022, and DTM-25-003 (July 2025) gave that office formal authority and created a chief zero trust officer role, because the existing organizational model could not execute zero trust. In the model, the solo operator with a fused posture often gets better outcomes than the siloed enterprise on a small fraction of the budget, because one human can act in seconds instead of escalating through three tiers.

The litmus test. One question separates viable architectures from performative ones: when your policy engine fails, when it denies a legitimate request or allows a malicious one, who pays, the attacker or the business? An architecture that makes the business pay for its own defense mechanisms is not zero trust. It is a liability the business will remove at the first false positive.

Adversarial stress-testing of the Octagon produced five forward-looking extensions. Functional preservation: the system must keep operating under attack without degrading to denial-first. Sovereign quorum: no single organization may unilaterally declare an entity trusted. Temporal epistemic integrity: provenance proofs have a shelf life set by the algorithms that secure them. Algorithmic impermanence: no algorithm is permanent, and migration is a continuous operation, not a flag day. Architectural polymorphism: a predictable topology is a modelable topology for machine-speed adversaries. The Octagon (eight axioms) is the deployment mandate. The Hendecagon (eleven) and Tridecagon (thirteen) are the research frontier. The extended axioms are not yet formalized with corollaries; the book treats them as acknowledged directions, and this report does the same.

The post-quantum transition makes the impermanence axiom concrete rather than philosophical. NIST’s draft migration guidance, IR 8547 (initial public draft, November 2024, with the companion draft SP 800-131A Rev. 3), sets the timeline: algorithms at 112-bit security strength, RSA-2048 among them, are deprecated after 2030 and disallowed after 2035, and the same draft disallows 128-bit-and-above RSA and ECDSA, P-256 included, after 2035. For national security systems, NSA’s CNSA 2.0 requires exclusive use of post-quantum algorithms by 2030 to 2033 depending on system class. The consequences for zero-trust architecture are operational, not cryptographic. ML-DSA signatures per FIPS 204 range from 2,420 bytes (ML-DSA-44) to 4,627 bytes (ML-DSA-87), against 64 bytes for an ECDSA P-256 signature, a roughly 38- to 72-fold increase. Every dimension that depends on signed artifacts feels this: attestation reports (D4), policy distribution messages (D6), attested telemetry (D7), SPIFFE/SPIRE certificate bundles on every mTLS handshake. In the book’s model, where a heterogeneous-triple attestation cycle runs every five seconds, ML-DSA-87 adds roughly 14 KB of signature data per cycle before the payload. The dimensions that are hardest to satisfy today are the ones the transition will hit first.

If the framework is useful, it is useful as an instrument, not as a position. Three moves:

Run the eight-question audit on your own architecture. It takes under an hour. "I don’t know" is a valid answer and a red flag. The eight questions are in the appendix below, mapped one-to-one to the axioms.

Apply the litmus test to your incident response. When your last false positive fired, did the business pay? If yes, your violation response violates Axiom 6, and no amount of identity investment fixes that.

Do not upgrade one dimension at a time. Move the cluster. And start with D8, because it is the only upgrade that costs nothing and it determines whether everything else you buy produces security or theater.

Score each axiom green, yellow, or red. Green means satisfied (pass), yellow means partially satisfied (partial), red means violated (fail). Only green counts as satisfied, so a yellow still fails the axiom; it is recorded separately because it tells you the axiom is closer to green. The violation matrix in Section 4 uses this rule.

1. Does any entity receive trust by virtue of its position, ownership, or history? (Axiom 1)

2. Can a neutral third party replay your access policy with a stored input set and reproduce the same verdict? (Axiom 2)

3. Is there any path to a resource that does not invoke the evaluation function? (Axiom 3)

4. What is the maximum time between verification and access, and is it risk-calibrated? (Axiom 4)

5. Can you calculate the exact maximum set of state transitions a compromised credential could authorize? (Axiom 5)

6. Does compromise of a single component cascade to the rest of the system? (Axiom 6)

7. Do state inputs to your policy engine carry cryptographic proof of provenance? (Axiom 7)

8. Does the client verify the resource’s state before sending data? (Axiom 8)

The book’s full rubric, with per-question scoring guidance, is Appendix B of the source work. Start with the lowest-cost fix or the highest-leverage one.