Abstract
A system is proposed herein for providing endpoint-identity and application/agent-aware policy enforcement using a single transported security group tag (SGT). An endpoint receives an identity SGT, and an ingress network edge obtains a destination group tag (DGT) and first applies an identity-SGT-to-DGT security group access control list (SGACL) decision. A denied flow is terminated. For an identity-permitted flow, a classifier identifies an application, software agent, or artificial intelligence (AI) agent and maps the classification result to a per-flow application/agent-derived SGT (App-SGT). Only the App-SGT is transported in existing packet metadata to an egress edge, where an App-SGT-to-DGT policy determines an action. The identity SGT remains available in session state and telemetry for correlation with both policy decisions.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Agrawal, Prachi; Viswanath, Sujith; Wargo, Shawn; Venkatraman, Rajagopal; and Phung, Stanley, "APPLICATION AND AGENT-AWARE SECURITY GROUP TAG / TWO-STAGE SECURITY GROUP ACCESS CONTROL LIST ENFORCEMENT", Technical Disclosure Commons, (November 10, 2026)
https://www.tdcommons.org/dpubs_series/12946