Where the Deny Lands

## The claim a gateway actually supports A zero-trust enforcement point denies exactly the traffic that reaches it. That is a statement about routing, not about architecture diagrams. When the deny lives on the front gateway of an internal container platform, what you have proven is: *requests that were routed to the gateway and refused did not reach the application*. You have proven nothing about requests that arrived by any other route. On a shared application platform, the arrows into one application typically look like this: | Path | Does the front gateway see it? | What an adversary needs | | --- | --- | --- | | User or partner request over north-south ingress | Yes | Nothing special — this is the path you designed | | Operator opens an interactive shell inside the running workload | No — it arrives through the platform's control API | A platform credential with exec-equivalent rights | | Node-level access to the host running the workload | No | A foothold on the node, or the node's own credentials | | Another team's workload calling this one directly | No — the traffic never leaves the internal network | An implant or a bug in any peer workload | | This application's batch job dialling out to a partner API | No — it is outbound | Control of the job, or of what the job talks to | | Legacy client connecting straight to the database or broker | No | Reachability plus the shared credential everybody has | | The platform's own management API answering on the management network | No — it is a different service entirely | Access to that network segment | The last two rows are the ones candidates forget, and they are the ones that get used. A legacy path exists because somebody could not be migrated; a management path exists because the platform has to be operable. ## Why this is the first question asked The common wrong answer is that the gateway is the chokepoint, so covering it covers the application. That is true only if every one of the rows above either does not exist or is separately denied. In a real estate none of them are absent — a platform without an operator path is a platform nobody can fix at 3am, and a platform without outbound batch traffic is not doing any work. So the honest answer to *where does the deny land* is a list, not a box. For each arrow you either: 1. **Route it through the same enforcement point** — put the internal callers through the gateway too, so east-west traffic pays the same toll. This costs latency, a hairpin through a shared box, and a capacity line item, and it does not work for paths the gateway cannot parse. 2. **Give it its own enforcement point** — a proxy in the workload's own network path, an admission check on the control API, a jump path with its own authentication for node access. 3. **Write it down as an exception with a named owner and an expiry** — the legacy client, the vendor appliance nobody can put an agent on, the break-glass path. Option 3 is not failure. Refusing to write it down is. An undocumented path is a path with no owner, and an owner is the only thing that ever gets it closed. ## What this costs Covering every arrow is where the money goes. Hairpinning east-west traffic through the front gateway multiplies its throughput requirement and puts every internal call behind one box's availability. Standing up a second enforcement point per workload means every workload now carries something extra that must be configured identically, and drift between two of them is a gap nobody can see from either console. Denying the operator path means the operator now needs an alternative that works under pressure, or they will find a way around it and you will discover that during the next incident. ## The wording that separates a good answer A good candidate does not answer with a control list. They answer with a drawing: here are six arrows into this application, the deny executes on one and a half of them, here is what I would do about each of the rest, and here is the name against the two I cannot fix this quarter. That is the artefact this question is fishing for.