Zero-Trust Architecture in Practice

Zero-trust is not a product — it is an architectural principle: never trust, always verify. Every request, regardless of origin, must be authenticated and authorized. No device is inherently trusted because it is on the corporate network. No user is inherently trusted because they logged in this morning.

The perimeter is dead. The new perimeter is identity.

The Three Pillars of Zero Trust

1. Verify explicitly — authenticate and authorize every request based on all available data points: identity, location, device health, service/workload
2. Use least privilege access — limit user access with just-in-time and just-enough access, risk-based adaptive policies, and data protection
3. Assume breach — minimize blast radius, segment access, encrypt end-to-end, use analytics to detect anomalies

Practical Implementation with Tailscale

For small teams, Tailscale delivers zero-trust access without the six-figure vendor contracts. It uses WireGuard for transport, distributes identity through its coordination server, and enforces ACLs per-device and per-tag.

// Tailscale ACL: zero-trust access control
{
  "tagOwners": {
    "tag:server":  ["autogroup:admin"],
    "tag:ci":      ["autogroup:admin"]
  },
  "acls": [
    // Developers can reach servers on specific ports only
    {
      "action": "accept",
      "src": ["group:developers"],
      "dst": ["tag:server:22,443,8080"]
    },
    // CI runners can reach servers on deployment ports
    {
      "action": "accept",
      "src": ["tag:ci"],
      "dst": ["tag:server:22,443"]
    },
    // Deny everything else
    {
      "action": "deny",
      "src": ["*"],
      "dst": ["*:*"]
    }
  ]
}

Beyond Network Access

Network-level zero trust is only the start. A complete implementation also covers: short-lived credentials (no long-lived API keys or SSH keys), mandatory device posture checks (OS patching, disk encryption, antivirus), continuous re-evaluation (not just at login time), and audit logging of every access event with immutable storage.