Skip to content
flowss
Start freeChecking your session
Graphviz (DOT) templates

Identity-aware application access boundaries

Makes authentication, authorization and service-to-service access separate trust decisions. Original worked design example; adapt responsibilities, thresholds and assumptions to your system.

Graphviz (DOT)ArchitectureGraphviz (DOT) syntax docs
Template previewGraphviz (DOT)
G user User device proxy Access proxy user->proxy request idp Identity provider policy Policy decision policy->proxy allow or deny proxy->idp verify identity proxy->policy authorize request app Application proxy->app scoped session logs Access audit proxy->logs decision data Data service app->data service identity data->logs data access posture Device posture posture->policy device evidence admin Policy owner admin->policy reviewed rules

What this template contains

Graph
Directed
Edges
10
Source
24 lines

Make it your own.

digraph G {
 graph [rankdir=LR, bgcolor="transparent", pad="0.3", nodesep="0.45", ranksep="0.8"];
 node [shape=box, style="rounded,filled", fillcolor="#edf4fa", color="#47728d", fontname="Arial", fontsize=12, margin="0.14"];
 edge [color="#64748b", fontname="Arial", fontsize=10];
 user [label="User device"];
 idp [label="Identity provider"];
 policy [label="Policy decision"];
 proxy [label="Access proxy"];
 app [label="Application"];
 data [label="Data service"];
 posture [label="Device posture"];
 logs [label="Access audit"];
 admin [label="Policy owner"];
 user -> proxy [label="request"];
 proxy -> idp [label="verify identity"];
 proxy -> policy [label="authorize request"];
 posture -> policy [label="device evidence"];
 admin -> policy [label="reviewed rules"];
 policy -> proxy [label="allow or deny"];
 proxy -> app [label="scoped session"];
 app -> data [label="service identity"];
 proxy -> logs [label="decision"];
 data -> logs [label="data access"];
}