This is the second article in our series on café networking. The first article established the stance: proxy-first access and no default network extension, with identity and device posture serving as the control plane, with policy and inspection in the cloud. On-premises remains lean, and an exception register tracks the owner, reason, and kill date.

This piece moves from definition to decision. It identifies the non-negotiables across networking and security and demonstrates how to keep them measurable in day-two operations, with choices informed by clear market signals. The third and final article will take these guardrails and scale them across site tiers, utilizing wave gates, coexistence rules, and sourcing paths.

The non-negotiables: Decisions to lock

Lock these before scaling by defining what the site physically hosts and how access is enforced. The networking items set the minimal branch footprint and traffic paths. The security items define authorization, inspection, and exception governance for day‑two.

Networking

• Minimal footprint at the site: Decide what lives on-premises and what does not. Keep only internet uplinks, lightweight CPE/NAT, and Wi-Fi to speed turn-ups and shrink the blast radius.
• Proxy-first as the default path: Require all user and device traffic to be evaluated in the cloud unless an approved exception exists. Track the share of traffic assessed in the cloud versus routed to prevent drift.
• Deterministic egress for the few: When a locality-bound or source-restricted flow is unavoidable, use IP anchoring and policy-based routing on a per-case basis. Treat each as a time-boxed bridge to modernization, rather than a second network.
• Resilience and degraded mode: Utilize dual-internet paths, perform clear health checks, and maintain an offline playbook. For real-time media, decide in advance which classes are fail-open and which are fail-closed, then test those decisions during change windows.

Security

• Identity and posture are the control plane: Make continuous access decisions based on the user's identity and the device's health status. Least privilege becomes portable across every site and network.
• Per-app private access: Reach private apps through outbound mutual transport-layer security (mTLS) connectors with per-app authorization and posture gates. Do not expose private apps to the entire corporate network by advertising enterprise subnets.
• TLS, quick UDP internet connection (QUIC), and domain name system (DNS) stance: Prefer modern TLS and QUIC. Pin DNS to the security cloud, and handle server name indication (SNI) or certificate-pinning edge cases with narrow, expiring exceptions that name an accountable owner.
• IoT/OT and third-party isolation: Treat each device as a network of one. Allow only least-privileged access, and keep guests and contractors on isolated, time-boxed paths.
• Exception register governance: Make the register a business control, not a parking lot. Every entry has an owner, a reason, a kill date, and a review cadence with a removal workflow, and a rollback plan. Review monthly, then remove or renew on the kill date with rollback.
• Day-two service level objectives (SLO) and safety nets: Publish inspection-latency and policy-propagation SLOs with error budgets and alarms. Instrument digital experience monitoring, track policy hit/miss and posture drift, and rehearse rollback after material control changes. Page on SLO burn and record outcomes as wave exit criteria.

Business lens: Market signals shift to single-vendor SASE

According to Dell’Oro Group’s 3Q25 SASE and SD‑WAN quarterly report, single‑vendor secure access service edge (SASE) represented 84% of total spending, with multivendor deployments comprising the remainder. Market revenue associated with single‑vendor solutions grew 24% year-over-year in the quarter, while multivendor spending grew 1%. The five-year forecast projects that single-vendor SASE revenue will reach 90% of total SASE market revenue by 2029. The data indicate a sustained shift toward single-vendor platforms across the period. In our taxonomy, a single-vendor provider means the provider offers both SD-WAN and secure service edge (SSE) solution capabilities. Multivendor reflects either a provider portfolio that lacks one pillar or the enterprise customer’s intent to mix SD-WAN and SSE from different suppliers to accommodate existing deployments and investments.

Lock it in, then scale

Codifying these decisions turns a promising pilot into a governable operating model. Agility improves because sites can stand up without extending a private network, and day-one becomes repeatable across microsites and branches. The same policy and inspection model applies to both in-office and remote users, simplifying administration and ensuring a consistent user experience.

Risk falls as lateral movement paths disappear and private apps are reached per application rather than per subnet. Operations gain predictability because inspections and policies reside in the cloud, changes propagate quickly, rollbacks are rehearsed, and audits trace decisions to owners and outcomes. Cost-to-serve trends down as hardware dependencies shrink and teams focus on identity, posture, and policy instead of boxes and wires. Treat these locked decisions as non-negotiable guardrails for wave one → regional → global, so scaling never backslides into network extension.

Next, we’ll take these decisions into the third and final article: Scaling up – from microsites to campus. We will map the blueprint to site tiers, define program waves and exit gates, manage coexistence where locality and real-time needs persist, and outline sourcing paths that support both single-vendor and unified approaches without presuming a single end state. Publish the decisions now, assign owners, and put them through the next change window so the scale-up can start from a stable base.