Pomerium Zero Trust Proxy

Provides access to browser-based internal applications through a reverse proxy without requiring a device agent, enabling secure access from unmanaged or contractor devices.

Grants access to individual named applications rather than network segments, users and devices can only reach explicitly authorized applications regardless of network position.

Re-evaluates user and device trust signals throughout an active session, revoking or stepping down access when anomalous behavior is detected, not just at authentication time.

Checks endpoint health (OS patch level, EDR presence, disk encryption, certificate validity) at each access request, enforcing minimum device security standards before granting application access.

Discovers internal applications accessible via VPN or direct network routes that should be brought under ZTNA policy, surfacing unmanaged application access.

Brokers authentication, upstream OAuth token injection, and per-tool authorization for AI agents calling internal Model Context Protocol servers through the access proxy.

Fronts the Kubernetes API server and maps identity-provider users and groups to cluster RBAC through impersonation or JWT authentication, replacing per-cluster kubeconfig credentials.

Proxies SSH natively with OAuth authentication and short-lived certificates issued per session, without a custom client, optionally recording sessions for audit.

Expresses per-route access rules in a declarative, version-controllable policy language evaluated on every request, distinct from console-only policy builders.