N7 — Zero-Trust Reference Architecture — Test Runbook¶

Asset: N7 — docs/architecture/zero-trust-reference.md. Owner: CO · Milestone: M4. Documentation asset — verification is a content review (offline, no live phase). Finishes the N network series.

Part A — Content review (~6 min, $0)¶

The doc covers the three zero-trust principles (verify explicitly, least-privilege, assume breach) and maps each to concrete SnowOps assets.
All five pillars are present — Identity, Devices/Endpoints, Network, Applications, Data — plus the cross-cutting Visibility/Analytics/Automation spine.
Every asset code cited resolves in docs/context/00-asset-glossary.md (spot-check the network row: F2/N1/N2/N3/N4/N5/N6).
The maturity & gaps table honestly flags roadmap gaps (Devices → O-series; Data → M4/M5/M7; Identity → H4/H6) rather than overclaiming.

Relative cross-links resolve:

python3 - <<'PY'
import pathlib, re
f = pathlib.Path("docs/architecture/zero-trust-reference.md")
bad = []
for t in re.findall(r"\]\(([^)]+)\)", f.read_text()):
    if t.startswith(("http://","https://","#","mailto:")): continue
    if not (f.parent / t.split("#",1)[0]).resolve().exists(): bad.append(t)
print("dangling links:", bad or "none")
PY

Expect dangling links: none.

Part B — Consistency with the rest of the repo (~4 min, $0)¶

The network pillar matches what's actually built: hub-spoke + forced egress (F2), connectivity LZ (N1), Firewall Premium IDPS/TLS (N2), WAF (N3), DDoS (N4), private endpoints (N5), NSG baseline (N6).
The maturity table's Baseline/Advanced framing is consistent with the tier tagging in the posture report and the control mappings.
No contradiction with the Information Security Policy (V1) umbrella — the policy's "defense in depth / least privilege / zero trust" statements are realized by this reference.

Notes¶

N7 is a reference, not a deployable module — it ties the already-built N/F/ H/M/J/K/E/S/C/I/D assets into one coherent zero-trust story for architects, auditors, and sales.