← Problem Library
Security L7 SECURITY-1330 · 15 min

A zero trust policy allows the service token and the backend still returns 403

The edge grants access, yet the application rejects the call because it expects a human identity field that machine traffic does not provide.

SecurityPlatform ReliabilityLevel 7Pro15 min
Scenario

A team automates health checks or API integrations with service tokens and later sees the backend deny requests despite successful edge-level authorization.

What to check first
  • Identify the primary failure signal in the Edge Access Allowed a Machine Identity the App Still Did Not Understand scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare edge identity model and origin authorization assumptions before widening Access policy.

Questions worth viewing together
What should you verify first when A zero trust policy allows the service token and the backend still returns 403 appears?

Community-field security problem inspired by Cloudflare Access patterns where service-token requests passed edge auth but failed origin authorization. Zero Trust success at the edge does not guarantee the origin app can interpret the caller identity correctly.

What usually causes A zero trust policy allows the service token and the backend still returns 403 in production?

Teams often blame Cloudflare Access policy when the origin app is enforcing a different identity contract.

What should you document after resolving A zero trust policy allows the service token and the backend still returns 403?

Machine identity rollouts should include origin-side authorization checks, not only edge policy tests.