Would you rely on VPNs and static credentials, or how do you architect a Zero Trust identity system for a globally distributed workforce accessing highly sensitive cloud workloads?

Likely follow-ups

• →How do you handle a legitimate emergency where an engineer needs break-glass access to a production workload but their device posture check is failing?
• →How does the policy engine's decision latency change as you onboard thousands of additional applications behind the identity-aware proxy, and where would that latency start to hurt?
• →If the identity provider itself is compromised, how do the ephemeral credential broker and continuous authorisation checks limit what an attacker can do with a forged identity?