Mythos Hardening Control · MRIS 2.0 · Applies to ISO/IEC 27001 and IT-Grundschutz

MHC-04 Workload identity and zero trust network architecture

Ties access to verified workload identities instead of network zones – reducing lateral movement once an AI attacker has initial access, and enabling the safe use of AI agents.

At a glance

Operational benefit: structurally reduces credential-based lateral movement after an initial compromise and limits the reachable blast radius; a service that has been taken over can no longer move on to neighbouring services through reused credentials. Within its own entitlements a compromised workload can still act — hence the combination with entitlement minimization and detection (MHC-05).
Policy affected: access control and network security policy.
Dependencies: forms the identity basis for MHC-13; has no precondition itself.
Effort drivers: migrating existing services ties up more resources than a greenfield build; the actual effort depends on the resources available to the organization.
Primary metric: share of production service-to-service connections with workload identity and mTLS.
Standards touched (no claim of fulfilment): among others ISO/IEC 27002 A.8.20/A.8.21/A.8.22, NIST SP 800-207 and 800-207A, NIS2 IR No. 6.7/8/11.

Control statement

Every production workload (service, process, container, AI agent) receives a unique, cryptographically verifiable identity with short-lived, automatically rotating credentials. The identity itself is stable and uniquely attributable; short-lived and non-reusable are the credentials derived from it (for example SVIDs, certificates, tokens). Communication between services is authorized on the basis of this identity, not on the basis of network position (IP address, subnet, perimeter). Advanced hardening (Managed level): extension to development and test environments and identity-based micro-segmentation.

Purpose and threat relevance

AI-accelerated attackers move from initial compromise to lateral movement within minutes. Classic perimeter, VPN and jump host models trust a service purely because of its network position; a host that has been taken over thereby gains de facto access to neighbouring services. Giving each workload its own identity removes the basis for that pattern: without a valid, short-lived identity no connection is established. The objective is to close the classic paths for lateral movement structurally. The protection rests on a cryptographic barrier, not on an attack merely being delayed.

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

Effect across frameworks
Number	Title	Classification / Level
ISO/IEC 27001:2022, Annex A 7 controls
A.5.15	Access control	partially degraded
A.5.16	Identity management	robust
A.6.7	Remote working	partially degraded
A.8.2	Privileged access rights	robust
A.8.20	Networks security	partially degraded
A.8.21	Security of network services	partially degraded
A.8.22	Segregation of networks	partially degraded
IT-Grundschutz, MRIS.bd 1 requirements
MRIS.bd.2.3.A1	Introducing Workload Identities and Identity-Based Access Control	Basic

All 93 controls in the analysis matrix · All 23 requirements of the module family

Maturity path

Initial: SPIFFE/SPIRE for privileged workloads; mTLS on the 3–5 most critical service-to-service paths.
Defined: workload identity for all production microservices and for all production AI agents and agentic workflows falling under MHC-13; ZTNA for privileged remote access.
Managed: full coverage including dev/test; identity-based micro-segmentation; AI agents with capability-scoped identities.

Measurement and audit evidence

Metrics: share of production service-to-service connections with mTLS/workload identity (target at Defined: 100% in production); time to withdrawal of a workload identity.
Stage gate (guide value): Initial — SPIFFE/SPIRE identities for 80% or more of privileged service workloads; Defined — mTLS mandatory for east-west traffic: 100% of in-scope connections or documented, time-limited and risk-approved exceptions (95% or above only as a transition threshold, not as full fulfilment of Defined); Managed — attestation-supported access policies in production. Gate fulfilment recorded as a yes/no attestation in project controlling (MRIS Chapter 10.6).
Evidence: SPIRE registry (inventory of issued identities), service mesh policy configuration, logs of mTLS enforcement.
Evidence logic (following ISO/IEC 27001, Clause 9): documented? — via the SPIRE registry; responsible? — the platform team; frequency? — continuous (renewal at minute to hour intervals); tolerance? — no production shared secrets stored in cleartext on critical paths.

Typical mistakes

mTLS remains in permissive mode (cleartext continues to be accepted) — no protective effect.
Identities with too long a validity (days instead of minutes) — the advantage of the short lifetime is lost.
AI agents continue to operate under personal developer accounts — traceability and entitlement limitation are missing.
IP-based allow-listing as a permanent parallel path instead of a time-limited, documented exception.

Delimitation and residual risk

Delimitation: protects the service-to-service level; the authentication of end users is covered by MHC-03; the governance of AI agents is developed further in MHC-13.
Residual risk: a compromised issuance infrastructure (SPIRE) or a legitimately credentialed but compromised service remain effective attack paths; an identity does not replace entitlement minimization (least privilege remains necessary).
Effectiveness limit: zero trust is an architectural path, not a product. Segmentation or workload identity implemented only in part can create false confidence; effectiveness arises only once authentication, authorization and least privilege take effect consistently and verifiably.
ISO/IEC 27002:2022: A.5.15 Access control; A.5.16 Identity management; A.6.7 Remote working; A.8.2 Privileged access rights; A.8.20 Networks security; A.8.21 Security of network services; A.8.22 Segregation of networks.
Framework: NIST SP 800-207 (zero trust principles); NIST SP 800-207A (cloud-native zero trust, workload identity, service mesh); SPIFFE/SPIRE (CNCF).

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog