Authenticate the user. Verify the device. Authorise the action.

No single check grants universal trust

A valid password does not establish a healthy endpoint. A known IP address does not prove device identity. A recognised filename does not identify its contents. Even valid MFA does not demonstrate that an application or requested operation is safe.

The proposed access decision combines who is acting, what resource or object is involved, device identity and posture, network context, the requested action and current behaviour. The allowed authority is the intersection of those conditions. Passing one requirement cannot cancel another requirement that failed.

MFA by default, through existing identity systems

The design assumes MFA for interactive users wherever technically possible. Privileged and sensitive access should favour phishing-resistant methods such as passkeys, FIDO2 security keys or Windows Hello for Business through a supported customer identity platform.

Different resources may need different authentication strengths. Machine identities require appropriate workload credentials and scoped authority rather than a human MFA prompt. Legacy systems need explicit handling and compensating controls. An identity-provider integration is a product capability to verify, not something established by listing a protocol or vendor.

When trust changes, step up the check

A new device, changed device certificate, attestation mismatch, failed posture, unusual session activity or a sensitive administrative action can justify additional authentication and re-evaluation. Leaving quarantine should also require evidence that the underlying issue was resolved.

Repeated authentication failures or an important integrity mismatch may increase risk. A changed location or network alone can be benign, so the response should consider context. The intended system avoids repeatedly interrupting ordinary work when identity, posture and behaviour remain within policy.

Successful step-up authentication is one piece of evidence. If the device still fails a required security condition, a user cannot simply approve a prompt to override it. Scoped exceptions, when appropriate, need explicit policy and an accountable decision.

Public websites and private services need different rules

A public website is deliberately published for unknown visitors. Blocking every unfamiliar IP would stop it serving its purpose. Public HTTPS therefore needs its own exposure and application-security policy.

Private infrastructure has a different audience. SSH, RDP, SMB, databases, management APIs, hypervisors, backup consoles and Remedy management surfaces should be reachable only through authorised paths. Default deny means no private access unless the identity, resource and action have been permitted; it does not mean treating all web visitors as hostile.

Minimum authority for normal and privileged work

An employee laptop should receive access to resources required by its role. A privileged administrator may need stronger authentication and a narrowly scoped management session. An unknown endpoint can be limited to enrolment or remediation paths. An external document can receive a temporary copy without corporate LAN authority.

These are examples of applying least privilege to the current task. Permissions should be reassessed when material evidence changes, rather than remaining valid indefinitely because a user logged in earlier. Access logs and policy versions make those decisions reviewable.

Current status and evaluation boundaries

The integrated AI Defence MFA, SSO, adaptive access and step-up workflow are planned. Authentication code in the separate Remedy platform does not establish this security boundary for AI Defence. Any evaluation should confirm the identity provider, device posture sources, supported enforcement points and failure handling.

Zero Trust is an established security discipline. Remedy’s contribution is its proposed connection between access, measured content, containment, authorised repair and evidence for restoring trust. Existing endpoint protection and recovery planning remain necessary.