Edge & Network

Zero Trust & SASE

Identity-, device- and context-aware access to every application · secure web gateway, CASB, DNS security and segmentation

Allowed flows between zones

From	To	Ports	Purpose	Flows · 24 h	Status
User workstations	AFC OS app tier	443 via broker	Application access	412 k	Enforced
AFC OS app tier	Case database	5432 mTLS	Queries	18.2 M	Enforced
AFC OS app tier	HSM enclave	PKCS#11 over TLS 1.3	Key operations	1.1 M	Enforced
goAML bridge	SWIFT secure zone	None	Not allowed	0	Enforced
SWIFT secure zone	Internet	None	Not allowed	0	Enforced
Developers	Production database	None · JIT only	Break-glass	2	Enforced

Zones and their workloads

DMZ · edge and portals

22 workloads

Application tier

Data tier

HSM enclave

SWIFT secure zone

Management

Default deny between zones. A new flow needs an owner, a purpose and an expiry, and the AI flags flows that no workload has used for 30 days.