One of the first architecture decisions is how and where authentication is performed, guided by the digital identity guidelines, the federal zero trust strategy and the identity playbooks: a federated identity provider serves multiple clouds and on-premises resources, multi-factor authentication is checked against government requirements such as PIV or phishing resistance, identity and assessment logs feed a SIEM so alerts trigger on selected activity and automated corrections and rollbacks follow, authentication realms are carefully managed and reduced (platform services remove server-level realms), least privilege is enforced within each realm with assessments detecting over-privileged accounts, and cloud infrastructure entitlement management is considered to enforce least privilege and monitor authorisations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.