Before microsegmenting, the enterprise assigns each application or service a unique identity (network address based validation being neither feasible nor scalable behind proxies, address translation, migration and load balancers); establishes trust in that identity so it cannot be spoofed and can be verified continuously, for example a SPIFFE identity carried in a short-lived certificate or token; provides a robust, secure service discovery capability for all application resources; identifies the security requirements of all applications and services and groups those with identical requirements; and maps the application-centric groupings onto the physical or virtual infrastructure of the data centre topology.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.