Zero Trust and Page Shield: two different kinds of integrity
Zero Trust controls who reaches a system. Page Shield controls what runs once inside. A script-based breach often passes the first check and fails the second.
"Integrity" gets used as one word for two different questions. Zero Trust answers the first: who, or what, is allowed to reach a given system, verified every time, not just at the network edge once. Page Shield answers the second: once someone or something is on a page you control, is what is actually running there still what you shipped.
Most breach postmortems involving a third-party script pass the first question cleanly. Whoever loaded the page was a real visitor, on a real device, doing nothing unusual. The failure is entirely in the second question: a script tag from an analytics vendor, a chat widget, a payment field, got modified upstream and nobody on the access side would ever have caught it, because access was never the problem.
Access answers "who." Page Shield answers "what is running."
The bottom-left quadrant is the one that keeps happening in the wild: a legitimate visitor, on a page your team owns, loaded a script that changed without anyone on your side reviewing it. Access control has nothing to say about that case, because the visitor was never the problem.
The third leg: staying up and staying recoverable
The rest of what "integrity" covers is less dramatic and more common: a system that answers correctly and consistently, not just securely. Load balancing and health checks route traffic away from a failing origin before a person notices, and a backup and restore practice that has actually been tested is the difference between a bad deploy and a bad week.
Where the three connect
Access, script integrity, and system reliability are usually owned by different people, if they are owned by anyone, which is exactly why gaps form between them. Treating "integrity" as one practice rather than three unrelated checkboxes is what closes those gaps — the same discipline behind a strangler-fig migration that keeps a legacy system correct and running the entire time it is being replaced.
We implement Zero Trust, Page Shield, and reliability configuration as part of our Cloudflare implementation practice, applying the same rigor we bring to any modernization engagement: nothing changes until we know what is actually running today. Our own approach to protecting data in flight is in our security practices.
Check your own case
Where does your team stand on this?
The article describes the pattern. These take your answers and tell you which part applies to you — no signup to see the result.