Zero-Trust Octagon

Appearance

Illustration: three interlaced fabric layers wrapped by a continuous adaptive loop

Engineering — Reference Implementation

2026/2027 Identity Fabric Architecture ​

Spec5 min read

Purpose: State-of-the-Art ZTA architecture with Continuous Adaptive Trust (CAT) framework — three-layer Identity Fabric, OID4VC/EUDI Wallet integration, WebAuthn Enterprise Attestation, and EU AI Act governance.

Version: 1.0.0 | Last Updated: 2026-06-28 Dependencies: None (architecture reference — no code imports from other specs)

1. Macro-Architecture: The 2026 Identity Fabric ​

The legacy paradigm of a centralized Identity Provider (IdP) acts as a single point of failure and a high-value target. The 2026/2027 standard utilizes an Identity Fabric that splits identity into three distinct layers: [2, 3, 4]

  • The Verification Layer (eIDAS 2.0 / Smart-ID+): Legal identity anchoring and verifiable credential issuance.
  • The Authentication Layer (WebAuthn / FIDO2): Everyday, cryptographically bound, phishing-resistant telemetry and access gestures.
  • The Enforcement Layer (Policy Decision Points & Policy Enforcement Points): Continuous risk calculation driven by EU AI Act constraints. [5, 6, 7]
text
       [eIDAS 2.0 / Smart-ID+]           [WebAuthn / FIDO2]
         (Identity Anchor)               (Session Initiator)
                 |                               |
                 v                               v
  +-------------------------------------------------------------+
  |              Continuous Trust Engine (PDP)                  | <--- EU AI Act Compliant
  |   - Device Health  - Behavioral Risk  - Telemetry Scoring    |      Risk Model (Deterministic)
  +-------------------------------------------------------------+
                                 |
                                 v  (Short-lived, scoped access)
                   [Micro-Segmented Workloads]

2. eIDAS 2.0 & Smart-ID+: High-Assurance Ecosystem Integration ​

By the late 2026 mandate deadlines, all EU Member States must support the European Digital Identity Wallet (EUDI Wallet) built on the official Architectural Reference Framework (ARF). [8, 9, 10]

OpenID for Verifiable Credentials (OID4VC) [11, 12] ​

To accept eIDAS 2.0 Person Identification Data (PID) and Verifiable Attestations, implement the OID4VP (OpenID for Verifiable Presentations) protocol. [13]

  • The Flow: When a user logs in or executes a high-risk transaction, the Policy Decision Point (PDP) issues an OID4VP authorization request. User authorization occurs locally in their EUDI Wallet using device hardware biometrics.
  • Zero-Knowledge Proofs (ZKPs): Design the ecosystem to request selective disclosure. If a process requires verification that an employee is a certified auditor, request only the boolean verification attestation — do not ingest their full date of birth, national ID, or address. This satisfies strict GDPR data minimization principles. [14, 15, 16]

Integrating Smart-ID+ ​

Smart-ID+ moves beyond traditional out-of-band push notifications to prevent modern adversarial techniques like social engineering and prompt fatigue. [17, 18]

  • Device-Link Binding: Implement the Smart-ID+ API to enforce dynamic QR Code authentication on cross-device flows (desktop to mobile). This forces the physical phone camera to interact with a cryptographically signed, timestamped on-screen token, effectively breaking remote Man-in-the-Middle (MitM) relay vectors.
  • Modern Cryptography: Enforce RSASSA-PSS and SHA-3 signatures for all Smart-ID+ interactions to achieve alignment with modern eIDAS and NIST standards. [17, 19]

3. WebAuthn & FIDO2: The Phishing-Resistant Session Engine ​

WebAuthn handles session generation and local physical verification. To achieve SoTA Zero Trust, implement the following advanced configurations.

App Id & Facet IDs (FIDO2 Enterprise Attestation) ​

Configure WebAuthn to demand Enterprise Attestation. This allows the relying party to read the hardware authenticator's unique serial number or batch ID, enabling the infrastructure to whitelist corporate-managed YubiKeys while rejecting unmanaged consumer devices. [20]

Discoverable Credentials (Passkeys) with Strict Verification [21] ​

Enforce residentKey: "required" and userVerification: "required" flags in the WebAuthn options payload. This ensures the credential cannot be generated without an explicit biometric step (or device PIN) on hardware that stores the private key inside a non-exportable hardware enclave. [22, 23]

typescript
// SoTA 2026/2027 WebAuthn Registration Challenge Configuration
const publicKeyCredentialCreationOptions = {
    challenge: Uint8Array.from(crypto.randomUUID(), c => c.charCodeAt(0)),
    rp: { name: "Enterprise Core", id: "internal.enterprise.eu" },
    user: {
        id: Uint8Array.from("usr_01J2X...", c => c.charCodeAt(0)),
        name: "user@enterprise.eu",
        displayName: "User"
    },
    pubKeyCredParams: [
        { alg: -7, type: "public-key" },   // ES256 (ECDSA w/ P-256)
        { alg: -37, type: "public-key" }   // RSASSA-PSS with SHA-256
    ],
    authenticatorSelection: {
        authenticatorAttachment: "platform", // Enforce built-in enclave or "cross-platform" for YubiKeys
        residentKey: "required",             // Enforce Discoverable Credential
        userVerification: "required"         // Enforce biometrics/PIN on the device
    },
    attestation: "enterprise"                // Solicit enterprise hardware identity
};

4. NIS2-Compliant Continuous Adaptive Trust (CAT) ​

NIS2 demands that essential and important entities maintain strict risk management, supply chain integrity, and near-real-time vulnerability control. [24, 25, 26, 27, 28]

Transition from Point-in-Time to Continuous Evaluation ​

Traditional architectures check identity during authentication and issue a 12-hour cookie. A NIS2-compliant architecture uses the Shared Signals Framework (SSF / CAEP — Continuous Access Evaluation Profile). [29, 30, 31]

  • Endpoint Detection and Response (EDR) agents, MDM solutions, and cloud providers continuously stream events.
  • If an EDR agent reports malware on an active user's laptop, an SSF event tenant.identity.device.compromised triggers immediately.
  • The Identity Fabric interceptor automatically revokes all short-lived access tokens across all active microservices within seconds, without waiting for token expiration. [32]

Micro-segmentation and Cryptographic Scoping ​

Enforce Ephemeral OAuth2 Access Tokens with a lifetime limit of 5 minutes. Scopes must follow the principle of least privilege, mapping down to the specific REST endpoint or gRPC method requested. [33]

5. EU AI Act Governance in Identity Risk Models ​

When using Machine Learning (ML) or User and Entity Behavior Analytics (UEBA) to score session risks (e.g., impossible travel, typing cadence, behavioral drift), the ZTA must explicitly address the EU AI Act. [25]

Risk Classification & Prohibited Practices ​

Most identity analytics fall under Specific Transparency Risk or High-Risk AI Systems if used for employment selection or critical infrastructure access decisions. [34]

  • Prohibited Practice Avoidance: Strictly ensure that UEBA models do not use biometric categorization to infer emotional states or protected identity characteristics (e.g., gender, race, medical status), which are completely banned under the EU AI Act. [35]

Architecture Framework for Governance ​

  • Deterministic Fallbacks: Never allow an AI model to make an opaque, unreviewable decision to completely terminate or block a user's corporate identity. If an AI engine flags a session as high-risk, the system routes the request to a deterministic fallback: an immediate, high-assurance step-up challenge requiring an eIDAS EUDI Wallet re-verification or a physical WebAuthn hardware key touch. [36]
  • Audit Logs and Human Oversight: Store every data input used by the risk-scoring model in an unalterable, cryptographically signed audit log. The security engineering team must possess a documented "Kill Switch" capability to bypass malfunctioning or biased AI risk scoring engines instantly without dropping the system's baseline FIDO2 authentication checks. [37, 38, 39]

Engineering Checklist for 2026/2027 Deployments ​

  1. Root Out Shared Secrets: Audit all service endpoints; remove legacy TOTP, SMS, and password mechanisms. [40]
  2. Deploy OID4VP Resolvers: Configure edge gateways to ingest W3C Verifiable Credentials directly from official EU Digital Identity Wallets. [9, 10]
  3. Configure Cross-Device QR Binding: Update native applications to support the Smart-ID+ SDK to counter modern remote proxy phishing. [17, 19]
  4. Implement CAEP/SSF Hubs: Ensure the central policy engine acts as an SSF receiver to intercept and process live telemetry changes across the fleet.
  5. Enforce AI Compliance Logs: Maintain explainable AI workflows for all risk-scoring models to pass regional NIS2 and EU AI Act regulatory audits.

References ​

[1] https://www.ergon.ch/en/services/security/continuous-adaptive-trust [2] https://www.airitos.com/strategic-planning-for-the-2026-identity-and-access-management-frontier-a-comprehensive-framework-for-enterprise-security-and-resilience/ [3] https://kycaml.guide/blog/how-to-choose-the-top-identity-verification-software-in-2026/ [4] https://agentnetworkprotocol.com/en/specs/01-agentnetworkprotocol-technical-white-paper/ [5] https://www.linkedin.com/pulse/eidas-2-paradigm-shift-from-product-infrastructure-andré-casterman-mzkhe [6] https://cpl.thalesgroup.com/blog/access-management/passwordless-authentication-360-strategy [7] https://www.neurasec.co.uk/blog/eu-ai-act-uk-ai-regulation-what-you-need-to-know.html [8] https://interoperable-europe.ec.europa.eu/collection/rolling-plan-ict-standardisation/electronic-identification-and-trust-services-including-e-signatures-rp-2026 [9] https://yousign.com/blog/eidas-2-0-digital-identity-wallet-compliance-requirements [10] https://eu-digital-identity-wallet.github.io/eudi-doc-architecture-and-reference-framework/latest/architecture-and-reference-framework-main/ [11] https://institute.global/insights/tech-and-digitalisation/modernising-digital-id-systems-what-open-standards-and-open-source-software-really-mean [12] https://www.vouched.id/learn/blog/openid-for-verifiable-credentials [13] https://www.vouched.id/learn/blog/openid-for-verifiable-credentials [14] https://www.etsi.org/deliver/etsi_tr/119400_119499/119476/01.02.01_60/tr_119476v010201p.pdf [15] https://www.mdpi.com/1999-5903/17/10/448 [16] https://indicio.tech/blog/indicio-joins-nvidia-inception-program-to-bring-verifiable-credentials-to-ai-systems/ [17] https://www.skidsolutions.eu/news/smart-id-experience-the-next-generation-of-secure-authentication-now/ [18] https://www.smart-id.com/smart-id-plus/ [19] https://www.skidsolutions.eu/news/estonias-government-adopts-smart-id-to-strengthen-security/ [20] https://fidoalliance.org/fido-attestation-enhancing-trust-privacy-and-interoperability-in-passwordless-authentication/ [21] https://solguruz.com/blog/web-development-trends/ [22] https://www.smartmatic.com/cybersecurity/ [23] https://www.beyondidentity.com/resource/beyond-identity-opens-early-access-for-the-ai-security-suite [24] https://digikogu.taltech.ee/et/Download/59620ab8-f01e-4012-9392-9c78b2eeddc6 [25] https://www.infoguard.ch/en/blog/zero-trust-2026-cyber-defence-ai-compliance [26] https://schjodt.com/news/navigating-the-nis-2-directive-key-changes-and-compliance-strategies [27] https://www.linkedin.com/pulse/guardians-digital-realm-dissecting-nis2-nist-staveris-polykalas [28] https://www.pivotpointsecurity.com/falling-behind-on-cmmc-compliance-heres-how-to-catch-up-fast-2-2-2/ [29] https://www.tonic.ai/blog/how-data-masking-synthesis-support-zero-trust [30] https://blog.cloudflare.com/nist-sp-1300-85/ [31] https://www.techtarget.com/searchsecurity/tip/Best-practices-for-a-bulletproof-IAM-strategy [32] https://ironscales.com/blog/cyber-insurance-in-2026-what-to-prioritize-and-how-ironscales-helps [33] https://www.trevonix.com/blogs/7-pillars-of-zero-trust [34] https://www.compact.nl/articles/understanding-intersection-between-eus-ai-act-and-privacy-compliance/ [35] https://secureprivacy.ai/blog/high-risk-ai-eu-ai-act-checklist [36] https://appinventiv.com/blog/ai-agents-for-cybersecurity/ [37] https://www.linkedin.com/pulse/eu-ai-act-compliance-playbook-step-by-step-guide-high-risk-khan-g7htf [38] https://www.lumenova.ai/blog/effective-generative-ai-governance-2026/ [39] https://www.cybega.com/ai-employee-governance [40] https://www.microsoft.com/en-us/security/blog/2026/04/20/making-opportunistic-cyberattacks-harder-by-design/