← All modules — full architecture

Meridian Logistics — OpenZiti 2.0 architecture

High-level design — click any component to drill into its low-level design
Module 06: Policies & services — ABAC + posture · verified against OpenZiti v2.0.3 (field build 2026-09-22)
M06 · Policies & Services
✕ Close
Identity / population Posture check Service / controller (M03) Edge router Policy model Policy (Dial) Host
Control plane (M03) ctrl1 · ctrl2 · ctrl3 — OIDC provider role-attribute taxonomy identities #employee · #partner · #3pl + #remote-users services #yard · #partner-portal routers #er-onprem · #er-pub #er-docker Service · M04 (reused) Dial #employee Identities — two populations Entra ID · ott cert + TOTP Local Docker host M06 · new dials OUT · no inbound Dial #yard #posture-strong Dial #partner-portal hosts meridian-yard yard.meridian.internal · #yard service policies Dial = who uses · Bind = who hosts the portal Dial carries posture router policies who enters where + who carries ERP per population · SERP #all employees #employee (Entra) partner-01 #partner #3pl posture check OS · every dial partner-portal portal.meridian.internal · #partner-portal er-pp-01 Docker ER · host config types (host.v1/v2 · intercept.v1) RBAC permissions (BETA)
Tip: click the taxonomy, a population, a policy card, posture, a service, the Docker router, the control plane, or a concept chip.
From the course Enterprise Zero Trust Architecture with OpenZiti 2.0 · cawachlabs.com · Guides Meridian Logistics is a fictional company. © 2026 CawachLabs · by Girish Reddy. All rights reserved. Not affiliated with or endorsed by the OpenZiti project. Icons adapted from Lucide (ISC, parts MIT).
TrademarksMicrosoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies. Docker is a trademark or registered trademark of Docker, Inc. in the United States and/or other countries. Kubernetes, Helm and SPIFFE are registered trademarks of The Linux Foundation in the United States and/or other countries. OpenTofu is a registered trademark of LF Projects, LLC. Ubuntu is a registered trademark of Canonical Ltd. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Elasticsearch and Kibana are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries. Grafana is a trademark of Raintank, Inc. dba Grafana Labs. Other names belong to their owners. CawachLabs is independent and not affiliated with or endorsed by these companies.