Service Identity Does Not End at mTLS
A successful mutual TLS handshake can establish that both endpoints hold credentials accepted by their respective trust policies. In modern service platforms, that often happens inside sidecars, node agents, gateways, or transparent proxies rather than inside application code. The connection is encrypted, a workload identity has been authenticated, and the transport looks secure. That is still only part of the security decision. The authenticated peer may be the wrong workload for the requested operation. A proxy may know the peer identity while the application sees only a local connection. A certificate may remain valid after the workload’s authority has changed. A broad trust bundle may allow credentials from an environment that was never meant to reach a production service.