Service Roles

Each SASE service component may perform one or more separate roles in the SASE service. In one case, the IAM service may serve as the authentication role, while in another, it may serve as the target actor to validate an access request. Each role that's performed must be validated when it's initiated. For example, in real estate transactions, an agent may be a buyer, seller, buyer agent, seller agent, third-party consultant, owner, lender, trustee, mentor, and so on. At the same time, the same real estate agent may be a combination of several roles. This is conceptually like the components in a SASE service as they can play multiple roles, with each role being governed by a separate policy.

A role, subject to change, affects access according to the policy that's being enforced. In one role, a user or system may have full access but have no access in a similar role. For instance, the automated maintenance request system on an office copier machine may...