Authorization from request to enforcement
Model the subject, resource, action, context, policy, decision, enforcement, and application authorization chain.
Courses and learning paths
Turn security concepts into working access systems
Use the Academy paths for security engineering decisions. Use the Pomerium Zero Fundamentals course for guided product work.
Guided product work
Pomerium Zero Fundamentals course series
Pomerium Zero Fundamentals starts with the quickstart, then covers routes, policies, single sign-on, TCP and SSH connections, and custom identity providers.
Audience: For evaluators and operators who want guided practice with Pomerium Zero.
Outcome: Finish with a working protected route and a clear model for identity, policy, TLS, and upstream verification.
Before you start
- A free Pomerium Zero account.
- Docker installed.
- Docker Compose installed.
Academy curriculum
Choose a learning path
Build a zero trust architecture
Protect named resources through explicit verification, least privilege, complete mediation, and assumed breach.
Build secure software and web applications
Move from security requirements through safe implementation, browser boundaries, authorization tests, and vulnerability response.
Control human-to-agent-to-tool access
Preserve identity, delegation, consent, policy, credential custody, approval, evidence, and revocation through agent actions.
Design cloud-native access boundaries
Combine named application access, segmentation, workload identity, Kubernetes authorization, and multi-cloud trust.
Design Security for Real Human Systems
Build security that survives deception, pressure, support, recovery, insider authority, poor incentives, and daily work.
Engineer Privacy into Identity and Access Systems
Control personal data, metadata, identifiers, correlation, telemetry, inference, release, retention, and deletion across access systems.
Identity lifecycle and authentication
Design proofing, enrollment, authenticators, sessions, recovery, federation, and non-human identity as one system.
Operate and recover access systems
Govern, observe, detect, investigate, preserve evidence, contain, recover, and assure an identity-aware access system.
Protect application and service access
Design browser, API, service, SSH, TCP, and UDP access without losing identity or creating a direct bypass.
Protect data with applied cryptography
Learn cryptographic primitives, key systems, data lifecycle controls, storage protection, and migration without inventing protocols.
Secure Platforms and Trusted Components
Build justified trust from small enforcement components, hardened runtimes, boot evidence, isolation, and controlled information flow.
Security engineering for identity-aware access
Turn a protection need into boundaries, requirements, controls, evidence, failure behavior, and recovery.
Validate identity and access protocols
Validate TLS, X.509, OAuth, OpenID Connect, JOSE, WebAuthn, metadata, token, and version boundaries.
