Continuous identity assurance for Zero-Trust edge and IoT services

Purpose Long-lived authorisation can outlast its supporting identity, device and contextual evidence. This study develops a privacy-aware continuous identity-assurance framework for reversible Zero-Trust decisions in edge and Internet of Things (IoT) services. Design/methodology/approach Design Science Research structures the artifact. Seeded Monte Carlo analysis examines synthetic controller behaviour through baselines, matched legitimate-access calibration, sensitivity, ablation and adverse conditions. A Raspberry Pi 4 prototype measures incremental authorisation overhead, not security effectiveness. Findings Under reference synthetic assumptions, 38 of 100,000 post-boot endpoint-compromise requests met the ordinary-access threshold. Weight choice and behaviour-preserving malware exposed failure regions; missing or stale evidence caused availability loss. Matched calibration found no globally dominant controller: simpler alternatives matched FULL in the Reference condition, and B2 reduced false acceptance rate under behaviour-preserving malware. P2 added 0.117–0.207 ms mean server-processing latency beyond P1, supporting feasibility only for the tested prototype and loads. Practical implications Deployment should progress from sender constraint and evidence governance through observation, local calibration, shadow testing and controlled testing to reversible enforcement under owned accessibility, outage and rollback criteria. Social implications Purpose limitation, alternative verification, accessibility review, contestability and separation of security telemetry from employment, credit or reputation uses address continuous-observation risks; human outcomes were not evaluated. Originality/value Novelty lies in integrating evidence ageing, conservative missingness and uncertainty, non-compensable predicates, reversible authorisation, pre-collection privacy governance and deployment calibration, rather than in a new probabilistic trust primitive.