Bridging Experiment and Enterprise: Continuous Verification and Policy Enforcement in Zero Trust Microservices

Abstract

Zero trust security has become a cornerstone for protecting cloud-native systems, but its orchestration in distributed microservices remains largely confined to theoretical models and controlled experiments. Bridging this gap, this paper examines how continuous verification and fine-grained policy enforcement can be operationalized in enterprise-scale, heterogeneous, and multi-cloud microservices environments. We develop a reference orchestration model that integrates service mesh capabilities, mutual TLS, identity-centric controls, and DevSecOps-driven automation pipelines. Using a mixed-method evaluation, we combine simulation-based benchmarking with case-driven analysis to assess scalability, interoperability, and operational overhead. Results demonstrate that continuous verification effectively minimizes lateral movement and enhances resilience against evolving threats, but also introduces challenges related to automation complexity, performance trade-offs, and cross-vendor interoperability. Our findings highlight the need for adaptive orchestration strategies that balance strong security guarantees with operational feasibility and cost efficiency. To address this, we propose a set of design guidelines and practical orchestration strategies for secure deployment, monitoring, and maintenance in production-grade microservices. This research contributes both empirical evidence and actionable recommendations, advancing the state of knowledge from controlled experimentation toward enterprise adoption. The study is intended for security architects, DevSecOps engineers, and platform operators seeking scalable approaches to zero trust orchestration in modern microservices ecosystems.