01
Establish identity and scope
Identify Route Endlets, Service Endlets, identity services, machine-state signals; validate participating Endlets before admission.
Military & Defense
Continuously validated nodes · Architecture
Map the service path for continuously validated nodes.
Admit machines and workloads only after identity and state satisfy policy, then continuously reassess participating nodes.
Primary capability
EdgeControl
How it works
Trace the protected service path from admission to evidence.
Restrict fabric participation to machines and workloads that satisfy the defined identity and state policy.
02
Build the protected service path
machine identity and state → policy evaluation → fabric admission or denial → continuous reassessment → revocation when policy is no longer satisfied
03
Capture decision evidence
Review validation evidence, authorization decisions, policy release, key release, route participation with the responsible teams.
Architecture flow
Trace the protected service path and its control points.
machine identity and state
policy evaluation
fabric admission or denial
continuous reassessment
revocation when policy is no longer satisfied
Inputs
Route Endlets, Service Endlets, identity services, machine-state signals, admission policy, EdgeControl
Path
machine identity and state → policy evaluation → fabric admission or denial → continuous reassessment → revocation when policy is no longer satisfied
Evidence
validation evidence, authorization decisions, policy release, key release, route participation, re-attestation, and revocation events
Quick answers
Continuously validated nodes FAQs
Which technical path should the team review?+
machine identity and state → policy evaluation → fabric admission or denial → continuous reassessment → revocation when policy is no longer satisfied
Which evidence should reviewers collect?+
validation evidence, authorization decisions, policy release, key release, route participation, re-attestation, and revocation events
Who should review the architecture?+
cyber defense, endpoint engineering, platform operations, identity and policy owners
Continue the evaluation path
Evaluate continuously validated nodes with a representative scope.
Determine whether admission, continuous reassessment, and revocation behave as defined for representative compliant and noncompliant nodes.
Continue to Evaluation
