Demo library › Chapter 7
7 Only healthy, managed devices reach production.
pgAdmin requires a device with its firewall on; switch it off and access ends, with the failing check in the log. And Backlog's experience measured from every device.
The problem
The database console holds everything. Horizon Inc trusts Rickie with it - but not a laptop with its firewall switched off, whoever is signed in. And when someone says "Backlog is slow from home", the help desk has nothing to look at.
Lands with: security teams with a device standard, and IT teams who field "it's slow" tickets
Before you start
- Lab only - pgAdmin and Backlog are on the private estate.
- The lab's Windows client signed in as
, with administrator rights to switch the Windows firewall off and on.
Run it
The device is part of the policy
| Do | Say |
|---|---|
| Zero Trust → Team & Resources → Devices → Device posture: Windows firewall on, Windows 10 or later. | The Cloudflare One client reports these from every enrolled device, every few minutes. |
| Access controls → Policies → IT Admins only. | The policy pgAdmin uses now requires the firewall check, as well as the IT Admins group and a reason. Who you are, and what you are using. |
As Rickie, open https://pgadmin.corp.internal. | It works: the right person, on a healthy device. |
| Turn the Windows firewall off. Wait for the next posture report (up to five minutes), then reload pgAdmin. | Refused - same person, same password, same everything, except the device. Turn the firewall back on and access returns on its own. |
The experience, measured
| Do | Say |
|---|---|
| Insights → Digital experience → Tests → Backlog reachability. | Every enrolled device fetches Backlog over the private route every ten minutes. When someone says it is slow, the help desk opens this instead of asking them to run a speed test. |
What the audience should see
- pgAdmin opening for Rickie, then refused with the firewall off, then opening again.
- DEX results for Backlog, per device.
Where the evidence is
Access authentication logs: Rickie's refused request, naming the posture check that failed. Device posture: the firewall check failing for that device, then passing.
Known limitations
- Posture is re-evaluated on the client's schedule, so the refusal is not instant.
- Only native checks. Third-party posture (CrowdStrike, Intune) needs those subscriptions.
Part of: Replace the VPN · The full tour