Secure Identity Governance Architecture for Cloud-Native Enterprise Platforms in Regulated Industries

Abstract

Regulated enterprises are moving core business functions onto distributed, application programming interface (API) driven platforms, and in such platforms an access decision is no longer made once at a point of login. Each microservice, batch job, and cloud workload evaluates whether a caller is the identity it claims to be and whether that identity is permitted to perform the requested action. Strong authentication alone does not establish why access was granted, whether it remains appropriate, who approved it, or when it was last reviewed, and these are the questions a regulated organization is required to answer. This article develops a vendor-neutral reference architecture for cloud-native identity governance by synthesizing normative standards, primary protocol specifications, and peer-reviewed research on cloud-native access control. Unlike Zero Trust guidance, which specifies how a request is verified, and conventional identity and access management, which specifies how a credential is issued, the architecture’s distinguishing claim is a governance plane that holds entitlement and lifecycle state independently of the authorization plane that issues tokens-a separation that makes an entitlement reviewable, recertifiable, and revocable without touching the credentials that carry it. The architecture organizes identity governance into six planes and three flows connecting them, situates role-based and attribute-based access control, OAuth 2.0, OpenID Connect, JSON Web Token validation, policy decision and enforcement points, API gateway controls, service mesh authentication, and workload identity federation via SPIFFE/SPIRE within that structure, and traces one entitlement end to end-from approval through enforcement to scheduled review and revocation-as a worked illustration of the model. A discrete-event simulation, built for this article and reported with its parameters and code, estimates policy-evaluation overhead and revocation-propagation latency under stated assumptions; it is a simulation of the model’s behavior, not a measurement of a deployed system, and is reported on that basis. Four contributions are offered: the plane separation itself; a layered authorization model distinguishing authentication from role, organization, object, action, and field-level authorization; the treatment of workload identity as a governed lifecycle rather than an authentication mechanism; and worked applications to healthcare, financial services, and insurance settings. The model is intended to support the production of compliance evidence; it does not by itself establish regulatory compliance, which depends on organizational processes and controls beyond the technical architecture.