Zero Trust Architecture Must Be Holistic and Capability-Driven

Read Jason Garbis’s chapter in Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era, the new book from Zero Trust creator John Kindervag. Kindervag brought together leading security practitioners to explain how to build a Zero Trust architecture that holds up in the AI era. In Chapter 7, Garbis shows how to turn policy into real enforcement with capability roadmaps and a practical readiness model.

Introduction

AI has changed the pace of cyberattacks. Attackers can now find weaknesses, write exploits and move through a network in hours instead of weeks. Defenders can no longer count on keeping everyone out. What matters now is how far an attacker can get once inside, and how fast you can contain them.

To answer that question, John Kindervag, who created Zero Trust, brought together leading security practitioners. Each one wrote a chapter on one step of the five-step Zero Trust model. Numberline Security founder Jason Garbis wrote Chapter 7, which covers Step 3: Architect the Network.

When Policy Out Paces Enforcement

Many Zero Trust programs stall for the same reason. Teams know the policies they want, such as access decisions based on who is connecting, from what device, to which workload. But their enforcement points can’t express those policies. No policy language, however well written, can enforce a control you don’t have.

Jason’s chapter shows how to close that gap deliberately and in the right order.

What You’ll Learn in Chapter 7

A capability is more than a product.
Security capabilities span technology, process and people. A tool that no one is trained or staffed to run isn’t really a capability. Neither is a policy with no governance process behind it.

Zero Trust architecture is a system, not a shopping list.
Identity, network, device, workload and data controls have to share signals and enforce policy together. A pile of disconnected point solutions isn’t an architecture.

Three moves, in the right order.

1. Take stock of your current capabilities and what your enforcement points can enforce today.
2. Define your to-be architecture as one connected system across the Zero Trust pillars.
3. Build a capability roadmap that puts people and process milestones next to the technology rollouts.

A practical Red/Yellow/Green readiness model.
Using the CISA Zero Trust Maturity Model, the chapter shows how to rate each capability as ready, partial or not ready, and plan the work needed to improve it.

A roadmap where every capability unlocks a stronger policy.
A worked example follows a payment processing environment. It starts with a coarse network allow-list, moves to microsegmented east-west policy, and then adds cryptographically verified workload identity. Each step becomes enforceable only once the capability behind it is in place.

Architecture for the AI era.
Models, training data and AI agents are now part of what you protect, and non-human identities operate at machine speed. The chapter looks at how agent-to-agent access options, from direct API calls to MCP to gateway-fronted A2A, each support a different level of enforceable policy.

The Takeaway

The architecture diagram is a snapshot. Your Zero Trust program will actually run on the capability roadmap, which keeps policy ambition and enforcement capability moving in step

About the Book

Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era is an anthology edited by John Kindervag and published by Illumio. Fifteen chapters follow the five steps of Zero Trust, from defining the Protect Surface to monitoring and maintaining it. Contributors include Andrew Rubin, Rich Mogull, Chase Cunningham, George Finney, Tony Scott and others.

Ready to Put Chapter 7 Into Practice

Read the chapter, then let’s talk about your roadmap. Numberline Security helps organizations assess their Zero Trust capabilities and build roadmaps that turn architecture into enforceable policy.

Book a Meeting

Talk with the team behind Chapter 7.

Book a Meeting