A choke point makes control observable
Forcing traffic through one place is not only about blocking. It is about being able to see.
Ten routes with policy on each are ten things to verify and ten places to be wrong. One route is a single place to enforce, log and inspect. It concentrates risk, which is the trade, and in exchange it converts a question you cannot answer into one you can.
More on Architecture patterns
- A jump host concentrates administrative entryOne plank, every crossing
- A bastion should not become a general-purpose workstationIt only has the one job
- Bulkheads contain failureThe water stops at the wall
- Out-of-band management survives primary-path failureWhen the bridge is out
- A broker can separate clients from powerful credentialsChained to the bench
- A one-way gateway changes the threat modelWater does not fall upwards