Trust & architecture
SASE Mesh inherits the platform's security invariants — a zero-knowledge datapath, mathematical tenant isolation, a signed audit chain, default-deny access and a network-side auditor that proves the invariants hold. None of it is best-effort; each is enforced in code and checked in CI.
The invariants
Peers enroll by public key only. Private-key material is rejected with 400, and the exported wg-config carries a `# PrivateKey` comment where an assignable line would be — a raw-scan guard proves the omission. The control plane never holds the one secret the node must not share.
ADR-0072 · SS-26 §11B/§11Ctenant_id is first-class and hierarchical: an ancestor tenant can operate descendants, siblings are isolated, and a cross-tenant read returns zero rows. An automated cross-tenant pen test runs in CI (SE-NET004).
ADR-0019 · ADR-0059Every state-changing operation emits a Vault-Transit-signed audit-chain entry to SS-06, with 100% coverage checked by a nightly chain-coverage report and a signature verification walk. SOX + SOC 2 + NDPR baseline.
ADR-0014 · SE-NET005ZTNA policies name exactly who may reach one resource, on which ports, at what trust level, with posture enforced — everything unnamed is denied. Each request is evaluated into a recorded session verdict, target ≤100 ms.
SS-26 SASEA Zeek network sensor SPAN-taps a mesh segment and independently audits the overlay: a control-plane leak audit raises a HIGH finding if a private key is ever observed, and an MTU/fragmentation profile flags transit outside the 1280–1420 clamp.
SS-28 §29.10Residency path classes constrain which paths tenant traffic may take, with a validate + audit surface; CDE segments can be freeze-tested and put under an emergency policy. Tunnel/MACsec keys come from SS-05 Vault (ADR-0056).
ADR-0056 · SS-26 residencyTrust boundary
The SS-07 edge validates the SS-01 JWT and strips inbound claim headers; east-west is mTLS. At the edge TrustMesh=false — no service trusts a header it did not stamp.
Topology and NetworkPolicy live as SS-02 claims; tunnel and MACsec keys come from SS-05 Vault, not an embedded database (ADR-0056).
Mutating money/usage writes carry an Idempotency-Key (ADR-0039); telemetry ingest is deliberately append-only and fire-and-forget.
Compliance baseline
The audit hash chain (ADR-0014) gives a SOX + SOC 2 + NDPR baseline: a nightly chain-coverage report and a signature verification walk re-check that every state change is signed and unbroken. Tenant isolation is proven by an automated cross-tenant pen test in CI that must return zero rows. Retention is per ADR-0031, up to 7-year Vault-signed retention on Enterprise.
Go deeper
The zero-knowledge datapath, the mesh chaos-rig audit and default-deny ZTNA are all callable operations — see them on the capability deep-dives and in the console.