SentinelMesh: Zero-Trust Service Mesh Control Plane System Design

Back to Portfolio

Distributed Systems & Cloud APIs

Zero-trust service-mesh control plane for monitoring service-to-service traffic, policy decisions, audit events, alerts, and AutoScaleOS export health.

Zero-Trust Mesh | Policy Audit Stream | Security Metrics Dashboard

Live Demo

Why This Project Matters

Shows recruiters a security-aware backend system: service topology, policy bundles, denied traffic, rate limits, auth failures, and audit traces are visible in one operational dashboard.

Tech + Architecture Summary

  • Tech: React, TypeScript, Service Mesh, Zero Trust, Policy Engine, Observability
  • Architecture: sentinel-mesh.cloud -> mesh dashboard -> gateway audit stream -> policy bundle evaluator -> service trust map -> alerts + metrics summary -> AutoScaleOS export link.

Impact Metrics

  • Built a reviewer-facing zero-trust control-plane dashboard that surfaces active requests, allowed traffic, blocked traffic, rate limits, and authentication failures.
  • Modeled service trust relationships across auth, billing, workflow, and monitoring services with policy-version history and violation tracking.
  • Connected service-mesh metrics to AutoScaleOS status so security events, routing fallback, and scaling export health can be reviewed together.

Core Problem

Make distributed service security understandable without forcing reviewers to read raw gateway logs or policy files first.

Build Notes

What I Owned

I built SentinelMesh to make zero-trust service communication visible: not just whether services call each other, but whether those calls satisfy policy, auth, and rate-limit expectations.

Hard Lesson

The lesson is that security dashboards need explainability. A blocked request is only useful if the reviewer can see the actor, target, rule path, and trace quickly.

Next Enhancement

Next I would add a signed policy diff viewer so reviewers can compare policy bundle versions and see exactly why a route changed from allowed to denied.

High-Level Architecture

mermaid
graph LR
  Dashboard[SentinelMesh Dashboard]-->Gateway[Gateway Audit Stream]
  Gateway-->Policy[Policy Bundle Evaluator]
  Policy-->Topology[Service Trust Map]
  Gateway-->Alerts[Real-Time Alerts]
  Gateway-->Metrics[Security Metrics Summary]
  Metrics-->AutoScale[AutoScaleOS Export Health]

Production-Grade Capabilities

  • Service trust map with policy-driven allow relationships.
  • Audit stream, alert list, and policy violation surfaces for reviewer inspection.
  • AutoScaleOS export-health panel that shows cross-system operational integration.

Engineering Decisions

  • A rich mesh dashboard improves reviewer comprehension, but every panel must map back to a concrete runtime signal to avoid becoming decorative.
  • Strict deny/rate-limit visibility improves security posture, but the UI must separate policy failures from authentication failures for faster triage.
  • Linking SentinelMesh to AutoScaleOS improves cross-system story, but it also requires clear boundaries between security decisions and scaling decisions.

Behavioral + Impact Signals

  • Built security controls as observable product behavior instead of hidden backend-only logic.
  • Separated policy-denied, rate-limited, and auth-failure states for clearer incident triage.
  • Connected audit traces and topology views so communication tradeoffs are explainable.

Quality Guarantees

  • Policy-denied traffic is visible with subject, target service, method, path, and trace identifier.
  • Service topology stays understandable even when live backend data is unavailable by falling back to a safe preview topology.
  • Security metrics remain grouped by allowed, denied, rate-limited, and authentication-failure outcomes.

Recent Upgrades

  • Added SentinelMesh to the portfolio with live custom-domain access and a dedicated system-design page.
  • Positioned SentinelMesh as the zero-trust service-mesh/security-control project in the infrastructure portfolio.
  • Documented policy bundles, audit stream, security metrics, and AutoScaleOS integration as the main evidence path.

Outcome Highlights

  • Published a live SentinelMesh deployment at sentinel-mesh.cloud.
  • Exposes service trust map, real-time alerts, policy violations, policy versions, and audit stream panels.
  • Frames security work as operational evidence: reviewers can inspect what was allowed, blocked, and exported.