absolutely. in the case of openziti, the x.509 is the first authentication gate (optionally paired with ziti posture checks and mfa). everything from there is

absolutely. in the case of openziti, the x.509 is the first authentication gate (optionally paired with ziti posture checks and mfa). everything from there is least privileged, attribute-based access, at a service level. default is closed - access to no services (even if authenticated at the level of the private ziti network fabric overlay).