Security architecture: start with the trust boundaries

Start with the important paths

Security architecture is not a catalogue of devices. It describes the boundaries around critical services and the paths by which people, systems and suppliers may cross them.

Separate identity, access and privilege

Authentication verifies an identity; authorisation defines what it may do. Review administrative access, non-human identities and recovery paths separately from everyday sign-in convenience.

Design controls around dependencies

A segmentation plan must preserve necessary flows while reducing unnecessary reach. Document dependencies, test changes in a controlled sequence and keep a practical rollback path.

Include detection in the design

A control that blocks, a log that records and a team that responds have different purposes. Define the useful evidence and the response owner when designing the boundary, not after deployment.

Make acceptance observable

Use access tests, configuration evidence and controlled scenarios to verify the intended separation. Record exceptions and residual risk instead of declaring the entire environment secure after one successful test.