By Alan Terriaga

Multi-tenant Software-as-a-Service (SaaS) platforms operating in regulated financial services face a unique intersection of security, compliance, and operational challenges that traditional perimeter-based architectures cannot adequately address. This paper presents a practitioner framework for implementing Zero-Trust Architecture (ZTA) across all layers of an AWS-hosted SaaS application, with particular focus on the authentication, authorisation, and Know Your Customer (KYC) verification pipelines that underpin financial compliance obligations.

Drawing on direct engineering delivery experience leading IAM systems in regulated multi-tenant environments, we describe concrete implementation patterns across seven architectural layers: edge security, identity and authentication, fine-grained authorisation, machine identity, data protection, continuous monitoring, and developer access governance. We identify key failure modes, trade-off decisions, and compliance constraints that shape real-world ZTA deployments — aspects absent from theoretical frameworks but critical to practitioners.

The framework aligns with the CISA Zero Trust Maturity Model and Executive Order 14028 requirements. The platform context involves cross-tenant user identities spanning concurrent organisational affiliations with distinct KYC requirements per context — an authorisation complexity that conventional single-tenant frameworks do not address. The compliance burden is significant: US and Canadian financial institutions spend an estimated $61 billion annually on AML and KYC compliance [10], global AML system spend is projected to reach $51.7 billion by 2028 [11], and average per-firm operational spend stands at $72.9 million annually [12]. A specific contribution of this work is the application of Cedar — a formally verified, open-source policy language with provable correctness properties [22] — to fine-grained, per-request authorisation in a multi-tenant financial SaaS environment. To our knowledge, this represents one of the first documented applications of Cedar’s formal verification properties to the KYC verification lifecycle and per-tenant authorisation in regulated financial services. We further apply the STRIDE threat modelling methodology across all seven architectural layers, evaluating 35 threat scenarios and their controls. We conclude with discussion of emerging challenges introduced by agentic AI workloads and the extension of ZTA and KYC principles to non-human identities.

Source SSRN