Build zero-trust boundaries around a legacy trusted network

• Inventory identities, communication paths, data sensitivity, admin surfaces, and recovery traffic. Define the target trust assertions and which legacy protocols cannot carry identity.

• Use flow logs to map hundreds of services and rare paths over a representative window. Policy infrastructure must handle peak calls and regional failure without becoming a universal outage source.

• Every request has verifiable workload and user context where applicable, authorization is least privilege, sensitive tiers are segmented, and enforcement rolls out without hidden-path outages.

• Introduce workload identity, authenticated proxies or gateways, central policy distribution with local evaluation, and network segmentation as defense in depth. Place legacy services behind identity-aware facades and narrow egress brokers.

• Identity and delegation context propagate across hops with bounded lifetime and audience. Policy decisions log principal, resource, action, version, and reason while avoiding sensitive payloads.

• Policy publication is versioned and eventually distributed; emergency revocation has stricter freshness. Local last-known-good policy preserves availability within explicit validity.

• Start in observe mode, then deny low-risk unused paths, canary enforcement, and preserve audited break-glass. Policy-service outage does not turn into blanket allow; local policy decides by risk class.

• Remove shared credentials, prevent token forwarding, bind identity to deployment provenance, and protect admin planes separately. Network boundaries remain useful containment but are never sufficient identity.

• Track implicit-trust calls, policy allows and denies, shared credential use, path owners, stale policy, and break-glass activation. Make ownerless flows visible before enforcement.

• Proxies and policy checks add latency and operations; evaluate locally and focus deep inspection on sensitive boundaries. Breach-radius reduction is the primary value metric.

• A service mesh can accelerate identity but does not create correct authorization policy. Gateway facades reduce legacy changes but concentrate traffic; use both selectively under one trust model.

• Discover flows, issue identities, authenticate in shadow, authorize coarse resource classes, then refine actions and remove network-only rules. Migrate admin and high-value data paths first.

• Staff candidates frame zero trust as verified identity and least privilege, not a product purchase. They include rare-path discovery, local policy availability, break-glass, and staged denial.

Interviewer evaluation rubric