# Identity Control Plane: The Unifying Layer for Zero Trust Infrastructure

arXiv: https://arxiv.org/abs/2504.17759 · HTML: https://mlsanity.com/paper/2504.17759/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Apr 2025.

## Built on by (most cited first, 1 of 1)

- [Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things](https://mlsanity.com/paper/2505.23835/) (2025)

## Abstract (arXiv)

This paper introduces the Identity Control Plane (ICP), an architectural framework for enforcing identity-aware Zero Trust access across human users, workloads, and automation systems. The ICP model unifies SPIFFE-based workload identity, OIDC/SAML user identity, and scoped automation credentials via broker-issued transaction tokens. We propose a composable enforcement layer using ABAC policy engines (e.g., OPA, Cedar), aligned with IETF WIMSE drafts and OAuth transaction tokens. The paper includes architectural components, integration patterns, use cases, a comparative analysis with current models, and theorized performance metrics. A FedRAMP and SLSA compliance mapping is also presented. This is a theoretical infrastructure architecture paper intended for security researchers and platform architects. No prior version of this work has been published.