# Tactical Zero Trust Network Hardening

> Design practical zero-trust controls for tactical and expeditionary networks without breaking mission tempo. Use when units need resilient identity, segmentation, and degraded-mode cyber operations.

- Skill: `zwright8/tactical-zero-trust-network-hardening` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add zwright8/tactical-zero-trust-network-hardening`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zwright8/tactical-zero-trust-network-hardening/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zwright8 (https://skillmd.com/u/zwright8)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/zwright8/tactical-zero-trust-network-hardening

---


# Tactical Zero Trust Network Hardening

## Mission Scope

- Treat this skill as a planning and decision-support aid for U.S. warfighter missions in its domain.
- Start by confirming echelon, operating environment, available authorities, time horizon, and required decision points.
- Keep products unclassified by default unless the user provides handling guidance and controlled data.

## Workflow

1. Frame the mission problem using these core inputs: network topology, mission apps, identity providers, contested comms assumptions, recovery priorities.
2. Identify assumptions, decision thresholds, and what intelligence or reporting would invalidate the current plan.
3. Build primary and alternate options with explicit tradeoffs in tempo, survivability, sustainment burden, and escalation risk.
4. Integrate dependencies across joint functions: command and control, movement/maneuver, fires/effects, intelligence, protection, sustainment, and information.
5. Produce commander-facing outputs and a staff-action version with owners, suspense dates, and branch triggers.

## Required Output Format

Deliver results in this order:

1. Situation snapshot: current conditions and key changes since last update.
2. Recommended option: one clearly stated recommendation and rationale.
3. Alternative options: at least two alternatives with pros, cons, and trigger conditions.
4. Decision points: what must be decided now, later, or pre-delegated.
5. Staff tasking: who does what by when.

## Domain Products

Primary products for this skill: tactical zero-trust implementation plan, segmentation policy set, degraded ops playbook.

## External Tools and Protocol Integration

- Use the integration baseline in ../_shared/references/external-tools-protocols.md.
- Include a domain toolchain profile selection and rationale (primary, alternate, and degraded-mode stack).
- Prioritize these tools or tool families for this domain: IdM/PKI systems, SIEM/SOAR, endpoint and network telemetry tools.
- Specify outbound exchange format for recommendations and tasking (for example USMTF, VMF, Link 16 J-series, CoT, STIX/TAXII, OGC WMS/WFS/WMTS).
- Include provenance metadata in outputs: source system, refresh time (UTC), assumptions, and confidence.

## Interoperability Validation Checklist

- Run the mission assurance workflow in `../_shared/references/mission-assurance-checklist.md` before final release.
- Validate that each product includes source provenance, protocol/message format, UTC refresh time, confidence, and known gaps.
- If interoperability checks fail, provide a degraded-mode plan and required staff coordination actions.

## Tool Invocation Contract

- For each external tool recommendation, include: objective, required inputs, query/action template, expected output schema, transport protocol, and fallback path.
- Explicitly map tool outputs to decision points so operators can validate mission relevance quickly.
- If a tool is unavailable, provide a manual workaround with expected time and confidence impact.

## Guardrails

- Flag gaps where assumptions exceed evidence.
- Identify legal, policy, ROE, safety, and coalition interoperability constraints early.
- Separate facts, assessed judgments, and unknowns.
- Do not fabricate classified sources, authorities, or approvals.

## Tool Protocol Playbooks

- Use protocol examples in ../_shared/references/tool-protocol-playbooks.md to produce operator-ready tool invocation packets.
- Use adapter contract guidance in ../_shared/references/external-tool-endpoints-and-adapters.md to define endpoint schemas, transport, and fallback behavior.
- Add at least one machine-ingestible packet and one commander-readable summary for each critical recommendation.

## Domain Tool Packet Library

- Use scenario packets in ../_shared/references/domain-tool-packet-library.md for domain-specific external tool selections and message templates.
- Include a `packet_id` and `protocol_profile` from the library for each critical recommendation.
- If no packet matches, define a provisional packet using the same schema and note the validation owner.

## Domain Data Contract

- Use mapping guidance in ../_shared/references/joint-mission-data-contracts.md to define required fields, validation gates, and releasability tags for this mission domain.
- Ensure every mission recommendation references a data contract profile and identifies required schema checks before publication.

## Operational Learning Loop

- Use `../_shared/references/operational-learning-and-after-action-loop.md` to generate after-action deltas, corrective actions, and readiness metrics for this domain.
- Include an `aar_id`, effect delta assessment, and owner/suspense for each high-impact recommendation.
- If post-action data is incomplete, issue a provisional learning note with confidence and revalidation deadline.

## Readiness Certification Evidence Pack

- Use `../_shared/references/readiness-certification-evidence-pack.md` to define mission-essential task evidence, evaluator triggers, and certification confidence scoring.
- Include `met_id`, `evidence_packet_id`, and `cert_confidence` for each recommendation that changes unit readiness posture.
- If required evidence is missing, mark status as `provisional` and assign closure actions with suspense.

## Protocol Execution Sequence

- Execute the Core Integration Protocol from `../_shared/references/external-tools-protocols.md` as an explicit step sequence, not as guidance only.
- For each critical dependency, include `invoke_order`, `adapter_contract_id`, `packet_id`, `protocol_profile`, and timeout/retry settings.
- Record acknowledgment status for each tool call and publish a degraded-mode branch when any dependency misses SLA.
- Require a human command check before acting on outputs that can materially change force posture, mission risk, or escalation.

## Domain Toolchain Profile Binding

- Use `../_shared/references/domain-toolchain-profiles.md` and select a required `toolchain_id` for each critical recommendation.
- Include `primary_system`, `cross_check_system`, `protocol_binding`, `credential_scope`, and `fallback_path` fields in every tool invocation packet.
- Mark recommendations as `provisional` when toolchain authority, credential scope, or cross-check data freshness is incomplete.

## Tool Health and Trust Monitoring

- Use `../_shared/references/tool-health-and-trust-monitoring.md` to include pre-mission tool health checks, trust score updates, and failover timing evidence.
- Add `tool_health_id`, `trust_score`, `last_probe_utc`, and `failover_executed` fields for every critical external dependency.
- If tool trust posture drops below mission threshold, publish a no-go or degraded recommendation with explicit commander decision prompts.

## U.S. Joint Protocol Assurance Drill

- Use `../_shared/references/us-joint-protocol-assurance-drill.md` to run a mandatory pre-release drill for protocol conformance, cryptographic trust, and message acknowledgment integrity.
- Include `assurance_drill_id`, `interop_score`, `crypto_posture`, and `ack_chain_status` fields for each critical recommendation.
- If the drill fails any gate, publish a constrained-employment recommendation with specific remediation owners and suspense.

## Joint Operations External Toolchain Profiles

- Use `../_shared/references/joint-operations-external-toolchain-profiles.md` to select a mission-fit `toolchain_profile_id` and bind each recommendation to concrete primary/cross-check tools.
- Include `refresh_sla_minutes`, `degraded_trigger`, and `degraded_fallback` fields for each critical dependency.
- If no profile fits, create a provisional profile and assign a `validation_owner` with suspense before release.

## Human-Agent Command Escalation Matrix

- Use `../_shared/references/human-agent-command-escalation-matrix.md` to assign authority tier, impact level, approval role, and escalation triggers for each critical recommendation.
- Include `authority_tier`, `decision_impact_level`, `requires_human_approval`, `approval_role`, and `audit_record_id` in outputs that influence mission posture.
- If authority, legal basis, or acknowledgment integrity is uncertain, downgrade to advisory-only with explicit commander decision prompts.

## Mission Tool Authority Gates

- Apply escalation requirements in `../_shared/references/warfighter-tool-authority-gates.md` for high-consequence recommendations.
- Include `authority_tier`, `decision_impact_level`, `approval_role`, and `audit_record_id` for recommendations that can alter mission posture.
- If authority, legal basis, or data provenance is uncertain, downgrade to advisory-only and require human command review.

## Cross-Domain Integration Playbook

- Use `../_shared/references/cross-domain-integration-playbook.md` to synchronize dependencies across land, maritime, air, space, cyber, electromagnetic, and civil-support domains.
- Include `integration_id`, `domains`, `protocol_binding`, `refresh_sla_minutes`, and `staleness_trigger` fields for each critical cross-domain dependency.
- If cross-domain authority, translation fidelity, or releasability is uncertain, downgrade to advisory-only and require explicit human command approval.

## Mission Tool and Protocol Catalog Binding

- Use `../_shared/references/warfighter-external-tool-and-protocol-catalog.md` to select concrete tool suites and protocol stacks for this domain.
- Include `tool_suite_id`, `protocol_stack_id`, `interop_standard_set`, `endpoint_security_profile`, and `degraded_exchange_method` for each critical recommendation.
- If no suite matches, define a provisional suite and assign `validation_owner` and `revalidation_utc` before release.

## Zero-Trust Continuity Addendum (2026-03-10, Identity Reconstitution and Command Intent Sync)

- Add `tool_suite_id=ts-identity-proof-life-reconstitution-v1` + `protocol_stack_id=ps-identity-proof-life-reconstitution-stack-v1` when disconnected identity confidence falls below mission threshold or proof-of-life status is stale.
- Add `tool_suite_id=ts-disconnected-command-intent-reconciliation-v1` + `protocol_stack_id=ps-disconnected-command-intent-reconciliation-stack-v1` when command guidance forks create competing execution paths across tactical enclaves.
- Add `packet_id=DPL-IDENTITY-PROOF-LIFE-RECON-001` and `packet_id=DPL-DISCONNECTED-COMMAND-INTENT-RECON-001` for branches that alter authorization boundaries, credential trust, or command release conditions.

## Zero-Trust Expansion Addendum (2026-03-11, Denied Navigation and Convoy Counter-Ambush)

- Add `tool_suite_id=ts-denied-pnt-terrain-nav-recovery-v1` + `protocol_stack_id=ps-denied-pnt-terrain-nav-recovery-stack-v1` when zero-trust routing policy must preserve assured maneuver timing under GNSS spoofing/jamming.
- Add `tool_suite_id=ts-autonomous-convoy-counter-ambush-v1` + `protocol_stack_id=ps-autonomous-convoy-counter-ambush-stack-v1` when tactical network hardening recommendations directly impact autonomous convoy branch execution.
- Add `packet_id=DPL-DENIED-PNT-RECOVERY-001` and `packet_id=DPL-CONVOY-COUNTER-AMBUSH-001` for recommendations that shift trust boundaries, route authority, or engagement-risk posture.

## Zero-Trust Expansion Addendum (2026-03-11, Undersea Restoration and Coalition Cyber-EM Fusion)

- Add `tool_suite_id=ts-undersea-cable-restoration-traffic-priority-v1` + `protocol_stack_id=ps-undersea-cable-restoration-traffic-priority-stack-v1` when zero-trust routing policy depends on contested undersea transport restoration and mission traffic arbitration.
- Add `tool_suite_id=ts-coalition-cyber-em-oob-fusion-v1` + `protocol_stack_id=ps-coalition-cyber-em-oob-fusion-stack-v1` when trust posture recommendations require coalition cyber and electromagnetic order-of-battle corroboration.
- Add `packet_id=DPL-UNDERSEA-CABLE-RESTORE-001` and `packet_id=DPL-COALITION-CYBER-EM-FUSION-001` for recommendations that alter identity trust boundaries, network priority lanes, or release authorities.

## Domain Toolchain Override (2026-03-11, Strategic Warning and Evidence-Speed Expansion)

- Add `tool_suite_id=ts-strategic-ai-mobilization-indications-v1` + `protocol_stack_id=ps-strategic-ai-mobilization-indications-stack-v1` when hardening recommendations depend on warning-driven defensive posture shifts against adversary mobilization campaigns.
- Add `tool_suite_id=ts-coalition-ceasefire-evidence-sync-v1` + `protocol_stack_id=ps-coalition-ceasefire-evidence-sync-stack-v1` when network integrity recommendations must preserve legally admissible incident evidence synchronization at coalition boundaries.
- Add `packet_id=DPL-STRAT-MOB-WARN-001` and `packet_id=DPL-CEASEFIRE-EVIDENCE-SYNC-001` for branches that alter sensor trust posture, legal evidence handling, or alliance release controls.

## Domain Toolchain Override (2026-03-11, Expansion Wave X Addendum)

- Prioritize `tool_suite_id=ts-theater-denied-electronic-warfare-mission-data-reprogramming-cell-v1` + `protocol_stack_id=ps-theater-denied-electronic-warfare-mission-data-reprogramming-cell-stack-v1` when EW mission-data reprogramming and tactical trust restoration are interdependent.
- Add packet bindings `packet_id=DPL-TACTICAL_ZERO_TRUST_NETWORK_HARDENING-009` (primary) and `packet_id=DPL-TACTICAL_ZERO_TRUST_NETWORK_HARDENING-010` (degraded) to preserve release-authority traceability under denial.
- Include `validation_owner`, `revalidation_utc`, and `ack_chain_status`; if any are stale, downgrade to advisory-only and escalate to commander network authority.

## Domain Toolchain Override (2026-03-11, Expansion Wave XII Addendum)

- Add `tool_suite_id=ts-tactical-counter-disinformation-civil-signal-assurance-cell-v1` + `protocol_stack_id=ps-tactical-counter-disinformation-civil-signal-assurance-cell-stack-v1` when zero-trust branch recommendations must preserve trusted civil-warning release and command-channel narrative integrity under active information attack.
- Add `tool_suite_id=ts-joint-iamd-multi-node-radar-deception-recovery-cell-v1` + `protocol_stack_id=ps-joint-iamd-multi-node-radar-deception-recovery-cell-stack-v1` when trust-boundary decisions depend on resilient radar-track confidence and rapid deception recovery.
- Add `packet_id=DPL-TACTICAL-COUNTER-DISINFORMATION-SIGNAL-001` and `packet_id=DPL-IAMD-RADAR-DECEPTION-RECOVERY-001` for branches that alter network trust posture, release authority timing, or engagement-risk thresholds.

## Domain Toolchain Override (2026-03-11, Expansion Wave XIII Addendum)

- Add `tool_suite_id=ts-joint-ai-generated-order-integrity-and-commander-intent-deviation-cell-v1` + `protocol_stack_id=ps-joint-ai-generated-order-integrity-and-commander-intent-deviation-cell-stack-v1` when zero-trust recommendations depend on validating AI-authored orders against commander intent.
- Add `tool_suite_id=ts-theater-resilient-battlefield-cloud-federation-admission-control-cell-v1` + `protocol_stack_id=ps-theater-resilient-battlefield-cloud-federation-admission-control-cell-stack-v1` when trust posture depends on cloud federation admission governance under contested operations.
- Add `packet_id=DPL-AI-ORDER-INTEGRITY-001` and `packet_id=DPL-CLOUDFED-ADMISSION-001` for branches that alter trust boundaries, release authorities, or continuity assumptions.

## Domain Toolchain Override (2026-03-11, Expansion Wave XIV Addendum)

- Add `tool_suite_id=ts-coalition-host-nation-fiber-cut-and-backhaul-restoration-cell-v1` + `protocol_stack_id=ps-coalition-host-nation-fiber-cut-and-backhaul-restoration-cell-stack-v1` when trust-boundary recommendations depend on coalition telecom backhaul restoration and releasability-safe routing.
- Add `tool_suite_id=ts-joint-contested-biometric-pay-and-personnel-reconstitution-cell-v1` + `protocol_stack_id=ps-joint-contested-biometric-pay-and-personnel-reconstitution-cell-stack-v1` when disconnected identity confidence and personnel-accountability trust directly impact network authorization posture.
- Add `packet_id=DPL-COALITION-FIBER-BACKHAUL-RESTORE-001` and `packet_id=DPL-BIOMETRIC-PAY-PERSONNEL-RECON-001` for branches that alter identity trust, route authority, or continuity assumptions.

## Domain Toolchain Override (2026-03-12, Expansion Wave XV Addendum)

- Add tool_suite_id=ts-coalition-arctic-fiber-microwave-troposcatter-failover-cell-v1 + protocol_stack_id=ps-coalition-arctic-fiber-microwave-troposcatter-failover-cell-stack-v1 when zero-trust continuity depends on contested arctic transport failover and coalition service-priority routing.
- Add tool_suite_id=ts-joint-quantum-sensing-spoof-detection-governance-cell-v1 + protocol_stack_id=ps-joint-quantum-sensing-spoof-detection-governance-cell-stack-v1 when trust-boundary decisions depend on spoof-resistant sensing confidence and fallback policy control.
- Add packet_id=DPL-ARCTIC-TRANSPORT-FAILOVER-001 and packet_id=DPL-QUANTUM-SENSING-SPOOF-GOV-001 for recommendations that shift identity trust boundaries, route authority, or mission-data confidence thresholds.


## Domain Toolchain Override (2026-03-12, Expansion Wave XVI Addendum)

- Add tool_suite_id=ts-strategic-quantum-network-key-custody-and-compromise-response-cell-v1 + protocol_stack_id=ps-strategic-quantum-network-key-custody-and-compromise-response-cell-stack-v1 when zero-trust posture depends on compromised key-custody containment and cryptographic continuity.
- Add tool_suite_id=ts-homeland-defense-municipal-911-psap-cyber-survivability-cell-v1 + protocol_stack_id=ps-homeland-defense-municipal-911-psap-cyber-survivability-cell-stack-v1 when network trust boundaries must preserve military-civil emergency call continuity.
- Add packet_id=DPL-QUANTUM-NETWORK-KEY-CUSTODY-001 and packet_id=DPL-MUNICIPAL-911-PSAP-CYBER-001 for recommendations that shift trust boundaries, credential release controls, or life-safety communication authorities.

## Domain Toolchain Override (2026-03-12, Expansion Wave XVII Addendum)

- Add tool_suite_id=ts-joint-cyber-mission-assurance-and-hunt-forward-cell-v1 + protocol_stack_id=ps-joint-cyber-mission-assurance-and-hunt-forward-cell-stack-v1 when zero-trust recommendations depend on hunt-forward threat suppression and mission-system survivability across coalition enclaves.
- Add tool_suite_id=ts-joint-space-control-and-counterspace-mission-cell-v1 + protocol_stack_id=ps-joint-space-control-and-counterspace-mission-cell-stack-v1 when trust posture depends on protected space-control telemetry, SATCOM continuity, and escalation-safe counterspace branch controls.
- Add packet_id=DPL-CYBER-HUNT-FWD-001 and packet_id=DPL-SPACE-COUNTERSPACE-001 for recommendations that shift trust boundaries, cross-domain release authority, or strategic continuity assumptions.

## Domain Toolchain Override (2026-03-12, Expansion Wave XXIII Addendum)

- Add `tool_suite_id=ts-orbital-servicing-refuel-assurance-v1` + `protocol_stack_id=ps-orbital-servicing-refuel-assurance-stack-v1` when recommendations depend on contested space-logistics servicing continuity, custody confidence, or maneuver-safe refuel timing.
- Add `tool_suite_id=ts-denied-terrain-drone-resupply-nav-v1` + `protocol_stack_id=ps-denied-terrain-drone-resupply-nav-stack-v1` when branch viability depends on autonomous resupply route confidence through denied terrain.
- Add `tool_suite_id=ts-coalition-cable-landing-data-sovereignty-v1` + `protocol_stack_id=ps-coalition-cable-landing-data-sovereignty-stack-v1` when recommendations depend on sovereign data routing, coalition caveats, or cable-landing continuity.
- Add `tool_suite_id=ts-runway-ice-fog-autoland-assurance-v1` + `protocol_stack_id=ps-runway-ice-fog-autoland-assurance-stack-v1` when mission tempo is constrained by low-visibility runway conditions and autoland safety confidence.
- Add `packet_id=DPL-ORBITAL-SERVICING-REFUEL-001`, `packet_id=DPL-DENIED-TERRAIN-DRONE-RESUPPLY-001`, `packet_id=DPL-COALITION-CABLE-LANDING-SOVEREIGNTY-001`, and `packet_id=DPL-RUNWAY-ICE-FOG-AUTOLAND-001` for branches that materially alter commander GO/NO-GO posture.

## Domain Toolchain Override (2026-03-12, Expansion Wave XXIV Addendum)

- Add `tool_suite_id=ts-joint-cyber-em-spectrum-mission-reroute-v1` + `protocol_stack_id=ps-joint-cyber-em-spectrum-mission-reroute-stack-v1` when mission survivability requires synchronized cyber+EM rerouting under active disruption.
- Add `tool_suite_id=ts-theater-llm-opsec-prompt-injection-defense-v1` + `protocol_stack_id=ps-theater-llm-opsec-prompt-injection-defense-stack-v1` for AI-enabled C2 stacks exposed to prompt injection or retrieval poisoning.
- Add `packet_id=DPL-JOINT-CYBER-EM-REROUTE-001` and `packet_id=DPL-THEATER-LLM-OPSEC-INJECTION-001` for primary and degraded trust-restoration branches.

## Domain Toolchain Override (2026-03-12, Expansion Wave XXV Addendum)

- Prioritize `tool_suite_id=ts-joint-cislunar-logistics-interdiction-reconstitution-v1` with `protocol_stack_id=ps-joint-cislunar-logistics-interdiction-reconstitution-stack-v1` when strategic space logistics, custody confidence, or cislunar maneuver assurance directly affect mission risk decisions.
- Add `tool_suite_id=ts-theater-underwater-datacenter-cooling-grid-defense-v1` with `protocol_stack_id=ps-theater-underwater-datacenter-cooling-grid-defense-stack-v1` when mission outcomes depend on underwater compute resilience, cooling continuity, or cyber-physical load restoration.
- Add `packet_id=DPL-CISLUNAR-LOGISTICS-INTERDICTION-001` and `packet_id=DPL-UNDERWATER-DATACENTER-COOLING-DEFENSE-001` for recommendations that alter mission posture, contingency branches, or strategic continuity authorities.