The Consent Layer Beneath the Cable: Auditing Landlord-Controlled Paths in a UK Zero-Trust Estate

A zero-trust architecture is a logical argument about identity, device and policy. It is also a physical argument about whether a cable can reach the equipment that enforces it. In UK office blocks, colocation halls and leasehold campuses, that physical argument runs through risers, ducts, entry chambers and wayleaves controlled by someone other than the network team. The diagram usually stops at the logical edge. The building does not.

Why consent belongs in the control catalogue

A trust boundary is not only where packets are inspected. It is also where control changes hands. At the landlord boundary, access permission becomes an authorization decision made outside your identity provider, by a managing agent, a facilities team or a lease clause. That decision can determine whether a failed circuit is restored in four hours or four days.

Treating a wayleave as a procurement artefact misses the point. It is an availability control. It has an owner, an expiry date, an evidence trail and a failure mode. It belongs in the same governance conversation as certificates, privileged access and supplier assurance, not in a filing cabinet reviewed at rent review.

The diversity test that stops at the carrier

Carrier diversity is a common resilience claim. Physical path diversity is the claim that actually matters. Two circuits from two providers can enter the same building through the same chamber, rise through the same riser and depend on the same landlord consent. When that riser is flooded, damaged by building works or closed by a fire officer, the estate has one path, not two.

An audit should ask for path records, not just carrier names. Where records are incomplete, a joint site survey with the carrier and the building manager is more useful than another spreadsheet. The question is simple: if this entry point is unavailable, which circuits remain, and who has the legal right to repair them?

A practical test is to label each path by its physical dependencies: entry chamber, duct, riser, tray, landlord, consent. If two paths share a dependency that has no alternate, record them as a single path for resilience purposes. The carrier may still be diverse. The building is not.

Build a physical path register

The register should be small enough to verify and detailed enough to act on. For each path, record the building, the landlord or managing agent, the consent type, the parties, the expiry date, the renewal owner, permitted access hours, the emergency contact route, the key or permit method, the repair service level and the location of supporting evidence.

Keep the register honest by walking it. A quarterly inspection of entry points, riser doors and cable trays produces photographic evidence, reveals unauthorized additions and catches drift between the documented path and the installed one. Tamper seals and simple labelling help, but the audit value comes from comparing what is recorded with what is visible.

Test the contract, not just the clause

Reading a wayleave confirms that a right exists. Testing it confirms that the right can be exercised. A controlled test might request out-of-hours access for a simulated repair, using the published emergency contact route, and record the time taken to reach a named person who can authorize entry. Legal review should precede any live test, and the test should avoid disrupting building operations.

A right that cannot be exercised at 02:00 is a right on paper. The evidence from such tests is often more revealing than the contract itself, because it exposes rotated contacts, changed managing agents and permit systems that no one has updated.

The consent expiry calendar

Wayleaves, leases and Code rights expire, and landlords change. The Electronic Communications Code, in force since 2017 and amended by later legislation, shapes how operators secure and retain rights, but it does not remove the need for an internal calendar. Add consent expiries to the same 90/60/30-day review used for certificates and credentials. Assign a named owner for renewal, not a team inbox.

The calendar should also capture events that can invalidate assumptions: building sale, refurbishment, change of managing agent, planned works near entry chambers. These are change triggers, not administrative notes.

Emergency repair is an access scenario

Simulate a riser incident. Water ingress, fire damage or a contractor cutting a tray are plausible events. Who authorizes entry when the managing agent is closed? Who holds keys? Who can grant permission for a carrier to work outside normal hours? Who escorts the engineer? The answers should be tested quarterly, not discovered during an incident.

Landlord works deserve a notification requirement in the change process. A refurbishment that moves a tray or seals a chamber can remove resilience without touching a router configuration.

Evidence and cadence

Report a small set of measures to the board: percentage of paths with verified emergency access, consents expiring within twelve months, paths with a single consent dependency, and median time-to-consent in tests. Pair each measure with the evidence held and the owner accountable.

Zero trust reduces implicit trust in packets. It should also reduce implicit trust in paperwork. A consent layer that is mapped, tested and owned is not bureaucracy; it is the difference between a resilient path and a diagram.