The one sentence · every depth
Identity is continuously verified for every actor — human, service, and agent — at every call, across three planes: provision, signal, mediate.
Behind CF Access: role resolves from Duo SSO OIDC groups via /cdn-cgi/access/get-identity · outside Access: simulator mode · nav is authz-derived — absent means unrouted · session is a claim, revalidated on interval.