Zero-trust architecture from first principles — not products, not compliance checklists.
Zero-Trust Octagon is a comprehensive, vendor-neutral reference textbook that defines zero-trust through eight irreducible axioms (the Octagon), evaluates architectures through a nine-dimension morphological matrix, and provides actionable implementation pathways for organizations of every scale.
The Octagon — Eight axioms that form the mathematical invariant core of zero-trust. Any architecture failing one is not zero-trust.
- No Intrinsic Trust — Trust is a transient verdict, never a property
- Explicit, Verifiable Policy — Policy must be deterministic, replayable, non-contradictory
- Unbypassable Mediation — No path between subject and object escapes evaluation
- Continuous Verification — Verification is ongoing, not gated at session establishment
- Deterministic Bounded Authority — Every action carries a context-limited, proof-backed credential
- Byzantine Fault Tolerance — Trust is computed as consensus across a set of verifiers
- Epistemic Integrity — Distinguish cryptographically provable fact from policy-derived inference
- Bilateral Symmetry — Protect data flowing in both directions, not just outbound
The Morphological Matrix — A 9-dimension configuration space (trust anchors, identity models, enforcement layers, attestation modalities, violation responses, policy distribution, observability trust, organizational posture, human continuity) replacing linear maturity models.
Four Archetypes with Attack Traces — Full breach narratives against each archetype (Holy Grail, Fortune 500, Startup, Lean Defense) with cross-trace synthesis.
Implementation Trees — 24-month, 12-month, and 6-month roadmaps with gate checks, cost estimates, and failure pivots.
# Install dependencies
npm install
# Run the docs locally
npm run docs:dev
# Build for production
npm run docs:buildBrowse at http://localhost:5173 after running the dev server.
- Security architects designing zero-trust deployments
- SREs responsible for making security models survive production
- Security engineers evaluating detection stacks against first principles
- Technical leaders who need to understand why vendor suites still get breached
Prerequisites: Working knowledge of cloud-native infrastructure (containers, orchestration, service mesh) and basic cryptographic primitives (TLS, JWT, PKI).
| Part | Content |
|---|---|
| Part I — Foundations | The Octagon axioms, their refinement history, and use as a validation instrument |
| Part II — Architecture | The morphological matrix, dimension covariance, and meta-patterns |
| Part III — Reality | Four archetypal breach scenarios with full attack traces |
| Part IV — Action | Implementation decision trees with cost estimates and failure pivots |
| Appendices | Quantum/AI threat stress-test, validation checklist, glossary, quick reference |
- VitePress — Static site generator
- Node.js — Runtime
ISC