Final Design Lab
This final A13 lesson combines every identity architecture concept from the module into one fictional enterprise review. You will evaluate whether the design is ready, conditionally acceptable, blocked, or requires additional evidence.
All identities, policies, applications, logs, findings, and decisions are fictional. The lab is architecture and governance analysis only and does not involve real accounts, credentials, policy changes, or access testing.
Lesson Progress
High School Advanced • A13: Identity, Zero Trust, and Access Control • Lesson 10 of 10
Readiness Check
0/4 ready
Professional Challenge
Northbridge Learning Services is preparing a major identity architecture release. Most modern controls are well designed: workforce identities are federated, production workloads use named identities, privileged access is time-bounded, environment separation is enforced, and modern access paths are monitored.
The review also finds an unowned legacy reporting account, obsolete migration-admin eligibility, a stale context source affecting sensitive exports, an upcoming partner recertification, and one incomplete emergency post-use review. Your job is not to make the architecture look green. Your job is to decide what the evidence actually supports.
A professional review preserves good controls, isolates blockers, keeps uncertainty visible, and defines exactly what must happen next.
Learning Objectives
Integrate identity perimeter, zero-trust, federation, conditional-access, authorization-model, privileged-access, monitoring, governance, and usability evidence into one coherent architecture review.
Evaluate fictional identity-to-resource relationships using purpose, ownership, privilege, environment, lifecycle, trust assumptions, policy outcomes, monitoring coverage, and evidence freshness.
Resolve conflicting or incomplete evidence without turning Unknown, Conditional, or Blocked findings into false confidence.
Produce release criteria, remediation priorities, residual-risk decisions, and an architecture recommendation grounded in defensible evidence.
Complete an Enterprise Identity and Zero-Trust Review that serves as the final A13 portfolio artifact.
Integrated Architecture
A13.1 Identity Perimeter Map
Human, privileged, workload, external, temporary, and legacy identities; identity-to-resource paths; ownership and lifecycle.
Key question
Can every important access path identify who or what is acting, why access exists, what resource is reached, and who owns the relationship?
A13.2 Zero Trust Principles Assessment
Explicit verification, least privilege, bounded trust, resource-specific authorization, continuous evaluation, and exceptions.
Key question
Where does the architecture still depend on assumed trust instead of explicit, reviewable access decisions?
A13.3 Federation Trust Register
Identity providers, relying services, external federation, SSO scope, identity context, and trust lifecycle.
Key question
Does federation centralize authentication without accidentally broadening authorization?
A13.4 Conditional Access Decision Matrix
Identity, resource, privilege, environment, device/session context, evidence health, policy outcomes, and precedence.
Key question
Can the policy explain why each sensitive request is allowed, denied, stepped up, limited, or reviewed?
A13.5 Access Model Comparison
Roles, attributes, hybrid models, role explosion, attribute quality, maintainability, and reviewability.
Key question
Is each access model understandable enough to govern while still precise enough to enforce least privilege?
A13.6 Privileged Access Governance Register
Eligibility, approval, JIT activation, duration, administrative evidence, emergency access, and post-use review.
Key question
Is high-impact privilege temporary, attributable, bounded, observable, and lifecycle-managed?
A13.7 Identity Monitoring Coverage Matrix
Authentication, authorization, privilege, workload, federation, lifecycle, policy changes, source health, and alert ownership.
Key question
Can the organization see the identity decisions it relies on and distinguish healthy silence from missing evidence?
A13.8 Access Review Decision Register
Purpose, entitlement, lifecycle, ownership, activity evidence, exceptions, residual risk, remediation, and closure.
Key question
Should each identity-to-resource relationship still exist now?
A13.9 Security and Usability Tradeoff Review
Proportional controls, useful friction, accessibility, supportability, recoverability, false positives, and resilience.
Key question
Is the secure path realistic enough that legitimate users and operators can follow it reliably?
Assessment States
Current, consistent evidence supports the architecture claim and no unresolved material condition changes the conclusion.
The control can remain in use while a known, bounded condition is tracked to review or closure.
Evidence is insufficient, stale, conflicting, or unavailable, so a confident conclusion cannot be made.
A material access, ownership, lifecycle, or control problem must be resolved before approval.
A known residual risk has been explicitly approved by an authorized owner for a bounded period and scope.
The control or evidence domain does not apply to the reviewed architecture, with a documented reason.
Architecture Scenario
Purpose
Supports counselor workflows for student services.
Identities
Counselor workforce identities + Student Portal workload identity.
Resources
Portal, Student Support Database, Generated Report Storage.
Privilege
Standard counselor role; application workload permissions.
Federation
Workforce SSO for counselors.
Access model
RBAC for counselor duties; workload identity with resource-specific policy.
Monitoring
Authentication, portal authorization, workload authentication, database access.
Purpose
Supports approved infrastructure administration.
Identities
Platform Engineers with privileged eligibility.
Resources
Production management plane.
Privilege
JIT platform administration.
Federation
Workforce federation establishes identity before privilege activation.
Access model
Hybrid: stable admin eligibility + contextual activation.
Monitoring
Eligibility, activation, management audit, deactivation, post-use review.
Purpose
Supports external partner scheduling operations.
Identities
Scheduling Partner Support identities.
Resources
Scheduling Integration Console.
Privilege
Limited support role.
Federation
External federation from approved partner identity provider.
Access model
Hybrid: external support role + sponsor/review attributes.
Monitoring
Federation health, external sign-in, application authorization, review date.
Purpose
Supports approved analytics and reporting.
Identities
Reporting Analysts + legacy reporting account.
Resources
Reporting Dashboard, Sensitive Export, Generated Report Storage.
Privilege
Standard reporting + sensitive export under stronger policy.
Federation
Workforce SSO for analysts; legacy local identity remains outside federation.
Access model
Hybrid for analysts; legacy local permission set for historical job.
Monitoring
Reporting authn/authz, export decision, device-context source, partial legacy audit.
Purpose
Historical project-based migration administration.
Identities
Former Migration Project Administrator.
Resources
Migration Console.
Privilege
Project-bound privileged eligibility.
Federation
Temporary project identity relationship.
Access model
Hybrid project role + expiration attribute.
Monitoring
Project closure, privileged eligibility, activation history.
Purpose
Provides critical emergency administrative capability.
Identities
Emergency Recovery Operator.
Resources
Recovery-critical services.
Privilege
Emergency administrative access.
Federation
Emergency path exists for identity-service disruption.
Access model
Exceptional privileged access with strong governance.
Monitoring
Emergency activation, admin audit, incident timeline, post-use review.
Evidence Board
Evidence
Current workforce role + portal authorization + application owner confirmation.
Freshness / owner
Current — Student Services Application Owner
Implication
Routine counselor access is supported without unnecessary privileged-style friction.
Evidence
Workload binding + production environment scope + database authorization telemetry.
Freshness / owner
Current — Application Team + Data Platform
Implication
Network location is not used as the sole trust basis.
Evidence
Eligibility + activation + 60-minute duration + management audit.
Freshness / owner
Current — Platform Engineering
Implication
High-impact privilege is bounded to approved tasks.
Evidence
Most sessions complete; one emergency session has Partial post-use review.
Freshness / owner
Current — Security + Resilience
Implication
Emergency privileged architecture remains usable, but governance closure is incomplete.
Evidence
Current sponsor + limited support role + federation logs; review due in 30 days.
Freshness / owner
Current — Integration Owner
Implication
External access is legitimate but requires timely recertification.
Evidence
Environment-aware authorization + explicit staging-to-production denial.
Freshness / owner
Current — Analytics + Data Platform
Implication
Environment is part of identity scope and authorization.
Evidence
Workforce identity current; device-context source stale; fallback not fully defined.
Freshness / owner
Stale / Partial — Analytics Product Owner + Identity Platform
Implication
The design needs a governed fallback before the sensitive-export control can be considered fully reliable.
Evidence
Owner Unknown + historical permission set + Partial monitoring + no current exception.
Freshness / owner
Partial — Unknown
Implication
Production release cannot treat the legacy reporting path as governed.
Evidence
Migration project closed, but former administrator remains eligible.
Freshness / owner
Current — Migration Project Owner
Implication
Lifecycle governance is not yet fully enforced.
Evidence
Current workforce, workload, federation, and privileged telemetry.
Freshness / owner
Current — Identity Monitoring Owner
Implication
Modern identity paths have reviewable decision evidence.
Evidence
Routine workforce access low friction; privileged production activation uses targeted step-up.
Freshness / owner
Current — Identity Security Architecture
Implication
The design uses proportional rather than maximum friction.
Evidence
Emergency-only eligibility + incident approval + audit + mandatory post-use review.
Freshness / owner
Current — Resilience + Security
Implication
Architecture is resilient, but the incomplete prior review must close.
Fake Dashboard
Fictional integrated identity architecture review summary
Architecture domains
9
A13.1 through A13.9 integrated into one review
Evidence records
12
Identity, workload, privilege, federation, conditional access, governance, monitoring, recovery, and usability
Blockers
2
Legacy reporting identity and obsolete migration privilege
Final recommendation
HOLD
Core architecture is viable but blocker closure is required before full approval
Fake SOC Alert
Source: Fictional Identity Architecture Decision Board • Time: 10:24
Conflicting Evidence
Evidence A
Operational team says the account is still needed because scheduled reports continue to run.
Evidence B
Identity governance shows Unknown owner, stale entitlement metadata, Partial monitoring, and no current exception.
Architecture decision
Do not convert operational usefulness into Confirmed governance. Keep Blocked until purpose and ownership are established and the path is redesigned or retired.
Evidence A
Conditional-access policy requires current device context for sensitive export.
Evidence B
Device-context source is stale and the fallback path is not fully defined.
Architecture decision
Keep the control Unknown/Conditional and design a governed fallback; do not silently allow or permanently deny.
Evidence A
Historical approval shows the administrator was legitimately eligible during the project.
Evidence B
Project closure evidence shows the responsibility ended.
Architecture decision
Current lifecycle evidence overrides historical need. Remove the obsolete eligibility.
Evidence A
Recovery evidence shows emergency access was legitimately used and service recovery succeeded.
Evidence B
Mandatory post-use review remains incomplete.
Architecture decision
Keep emergency capability but classify the evidence Conditional until review closure is complete.
Fake Log Panel
[08:00] ZTARCH-01 workforce-perimeter state=CONFIRMED owner=STUDENT_SERVICES [08:12] ZTARCH-02 workload-identity state=CONFIRMED env=PROD scope=APP_ONLY [08:24] ZTARCH-03 privileged-jit state=CONFIRMED standing_privilege=NONE [08:36] ZTARCH-04 emergency-review state=CONDITIONAL post_review=PARTIAL [08:48] ZTARCH-05 partner-federation state=CONDITIONAL review_due=30d [09:00] ZTARCH-06 environment-separation state=CONFIRMED prod_crossing=DENIED [09:12] ZTARCH-07 sensitive-export state=UNKNOWN device_source=STALE [09:24] ZTARCH-08 legacy-reporting state=BLOCKED owner=UNKNOWN [09:36] ZTARCH-09 migration-eligibility state=BLOCKED project=CLOSED [09:48] ZTARCH-10 monitoring-coverage state=CONFIRMED modern_paths=CURRENT [10:00] ZTARCH-11 security-usability state=CONFIRMED friction=PROPORTIONATE [10:12] ZTARCH-12 recovery-access state=CONDITIONAL review=INCOMPLETE [10:24] ARCH-DECISION blockers=2 conditions=3 recommendation=HOLD
Training note: this is fake data for defensive analysis practice only.
Analyze the Evidence
Release Criteria
Required: Every production identity and material access path has a current owner or sponsor.
Current: Not met — legacy reporting ownership unresolved.
Required: Obsolete privileged eligibility is removed and current privilege is time-bounded.
Current: Not met — former migration admin eligibility still assigned.
Required: Sensitive export control has current context evidence or a governed fallback.
Current: Partially met — device-context source is stale and fallback incomplete.
Required: Partner access has current sponsor, narrow scope, and scheduled review.
Current: Met with upcoming review due in 30 days.
Required: Privileged activation, activity, deactivation, and required post-use review are complete.
Current: Mostly met — one emergency post-use review remains incomplete.
Required: Modern identity paths produce current authentication, authorization, privilege, lifecycle, and source-health evidence.
Current: Met for modern paths; legacy path remains a separate Blocked finding.
Required: Lower-environment identities do not automatically reach production resources.
Current: Met — staging-to-production access is explicitly denied.
Required: Controls are proportionate, supportable, accessible, and recoverable without broad bypass.
Current: Partially met — sensitive-export fallback requires redesign.
Remediation Register
Action
Identify accountable business/service owner, confirm current need, map resource scope, modernize into a named workload identity or retire the path.
Owner
Reporting Service Owner — currently unresolved
Closure
No production legacy identity remains without current ownership and reviewable authorization.
Action
Remove privileged eligibility because the approved migration project has ended.
Owner
Migration Project Owner
Closure
Eligibility feed confirms the former administrator can no longer request the project admin role.
Action
Restore device-context source health and define a governed fallback for approved sensitive exports during evidence-source disruption.
Owner
Analytics Product Owner + Identity Platform
Closure
Current context evidence or tested fallback supports a predictable policy outcome.
Action
Complete review comparing approved recovery purpose with observed administrative activity.
Owner
Security + Resilience
Closure
Review is signed off and all unexplained activity is resolved.
Action
Sponsor confirms continued business need, narrow access scope, and next expiration/review date.
Owner
Integration Owner / Partner Sponsor
Closure
Federation relationship is renewed, reduced, or expired before the current review deadline.
Action
Package current identity, policy, monitoring, privileged, and governance evidence into a versioned architecture review baseline.
Owner
Identity Security Architecture
Closure
Decision board can trace every major architecture conclusion to current evidence.
Decision Board
Named identities, federation, application roles, lifecycle, and monitoring are current.
Production workload has explicit identity, resource scope, environment alignment, and authorization evidence.
JIT model is strong, but the emergency post-use review must close.
Scope and sponsor are current, but scheduled review is approaching.
Required context evidence is stale and fallback behavior is incomplete.
Unknown owner, stale lifecycle, Partial monitoring, and ungoverned local access.
Project ended, so current eligibility has no valid business purpose.
Core architecture is strong, but two Blocked findings prevent a full approval decision.
Final Recommendation
The identity architecture demonstrates strong modern controls, but full approval should wait until the unowned legacy reporting identity and obsolete migration privileged eligibility are closed. Conditional findings should remain tracked through defined remediation and evidence-based closure.
Architecture Anti-Patterns
Why it fails: Most controls look healthy, so reviewers ignore a small number of high-impact unresolved findings.
Better approach: Use release criteria that prevent material blockers from disappearing inside aggregate scores.
Why it fails: A successful sign-in is used to prove the application authorization is correct.
Better approach: Keep authentication, authorization, privilege, and resource evidence distinct.
Why it fails: A project role remains because it was once legitimate.
Better approach: Use current lifecycle evidence to decide whether access should still exist now.
Why it fails: A legacy account remains because something depends on it, even though nobody owns the risk.
Better approach: Resolve ownership and modernize or formally govern the dependency.
Why it fails: A stale evidence source is treated as if its last value were still current.
Better approach: Use a visible fallback and preserve Unknown until evidence is restored.
Why it fails: Recovery pressure causes teams to skip review and evidence requirements.
Better approach: Keep emergency capability available but require strong post-use review.
Why it fails: A control is approved because it is restrictive even though users cannot reliably follow it.
Better approach: Evaluate friction, accessibility, supportability, recoverability, and resilience.
Why it fails: Findings remain open for months because nobody can define what complete means.
Better approach: Assign owner, priority, target action, and evidence-based closure criteria.
Scenario Decision Lab
Most modern identity controls are healthy, but the release still contains an unowned legacy reporting identity and obsolete privileged eligibility from a closed project.
Scenario Decision Lab
A sensitive export policy requires current device context, but the source is stale and the fallback process is incomplete.
Safe Final Lab
Use fictional identities, services, policies, access records, monitoring evidence, owners, findings, and decisions only. This is a defensive architecture and governance exercise.
Create an executive summary for the fictional architecture.
List all major human, privileged, workload, external, temporary, and legacy identity types.
Map at least fifteen identity-to-resource relationships.
Show which relationships use federation and which do not.
Show application/resource-specific authorization.
Show conditional-access decisions for sensitive actions.
Show RBAC, ABAC, and hybrid access-model decisions.
Show privileged eligibility, activation, duration, and review.
Show authentication and authorization monitoring coverage.
Show source-health states for important telemetry.
Show access-review decisions and lifecycle triggers.
Show external sponsor and expiration conditions.
Show workload identity ownership and environment scope.
Show security/usability tradeoffs for at least five workflows.
Create at least twelve integrated evidence records.
Create at least four conflicting-evidence records.
Define release criteria.
Identify Blocked, Conditional, Unknown, Confirmed, and Accepted Risk states where appropriate.
Create at least six remediation items.
Assign priority and owner to each remediation item.
Define evidence-based closure criteria.
Create a final decision board.
Issue an overall Approve, Approve with Conditions, HOLD, or Reject recommendation.
Explain why the recommendation follows from the evidence.
Create a one-page portfolio summary suitable for a school or internship portfolio.
Final lab boundary
Do not access real identity providers, user directories, privileged systems, logs, tokens, credentials, policies, or administrative consoles. Do not attempt authentication bypass, account enumeration, privilege escalation, session manipulation, or changes to live access controls.
Analyze the Evidence
Advanced Challenge
Prepare a concise review-board briefing that explains the design without drowning the audience in every log record. Your briefing should make the decision traceable from architecture claims to evidence, blockers, conditions, remediation, and final recommendation.
Architecture purpose
Identity populations
Trust boundaries
Federation model
Authorization model
Conditional-access model
Privileged-access model
Monitoring model
Access-governance model
Usability/resilience model
Top confirmed strengths
Top conditional findings
Top blockers
Conflicting evidence
Remediation plan
Final recommendation
The board should be able to answer three questions after your briefing: What is safe enough to keep? What remains uncertain? What must close before the architecture can be approved?
Defender Habits
Skill Check
Check Your Understanding
Choose your answers first. Explanations appear only after submission.
Portfolio Prompt
Create the final A13 portfolio artifact: an Enterprise Identity and Zero-Trust Review that integrates your A13.1–A13.9 work. Include executive summary, architecture scope, identity populations, trust relationships, federation, conditional access, RBAC/ABAC, privileged access, monitoring, access reviews, usability/resilience, integrated evidence records, conflicts, release criteria, remediation register, final decision board, and overall recommendation.
Confidence / Readiness Reflection
The module test will evaluate your understanding across all ten A13 lessons. Before continuing, make sure you can reason from identity architecture evidence rather than memorizing individual terms.
I can map identity-to-resource relationships and trust boundaries.
I can explain zero trust, federation, conditional access, RBAC/ABAC, and privileged access together.
I can evaluate monitoring, evidence freshness, and access governance.
I can balance security strength with usability, recovery, and operational resilience.
I can issue an architecture decision with blockers, conditions, remediation, and closure criteria.
Portfolio Build Guide
State the overall recommendation and the most important reasons before presenting every detail.
Use stable IDs so each architecture conclusion can be connected to current evidence.
Do not present a due-soon review as equivalent to an unowned production identity.
Stale or conflicting evidence should remain visibly uncertain until resolved.
Every access path, finding, exception, and remediation item should have an accountable owner.
Define what evidence proves each remediation item is actually complete.
Do not redesign healthy identity paths simply because another part of the architecture has a blocker.
Use this review as the study map for A13's identity, zero-trust, access-control, monitoring, and governance concepts.
Key Takeaways
Lesson Safety Boundary
Do not access real accounts, identity providers, privileged consoles, logs, credentials, tokens, policies, or production systems. Do not attempt authentication bypass, account enumeration, privilege escalation, session manipulation, or access-control changes. All evidence and architecture records are fictional.
Lesson Complete
You have now integrated all A13 identity, zero-trust, authorization, privileged-access, monitoring, governance, and usability concepts into one Enterprise Identity and Zero-Trust Review. The next step is the A13 Module Test.