Performance Projection Modeling of Distributed Identity and Access Management (IAM) under High Concurrency in Zero-Trust Architectures

*** PREPRINT / AUTHOR-ACCEPTED VERSION ***This paper was presented at the conference and is the author-accepted camera-ready version. It is posted here for self-archiving purposes in accordance with the IEEE Author Posting Policy prior to official publication and indexing in IEEE Xplore. Abstract— Zero-Trust Architecture (ZTA) fundamentally reframes network security by eliminating implicit trust and enforcing continuous verification of every access request. While recent literature focuses on cryptography and identity correctness, a crucial performance aspect — the cost of continuous authentication for high-concurrency workloads — remains underexplored. In this paper, we present a performance projection analysis of bottlenecks in three possible IAM implementation architectures: centralized RBAC-based, deep-learning-based continuous behavioral authentication, and blockchain-powered ZKP-based, under concurrent user loads ranging from 100 to 10,000 authentication requests. In order to project request latency, system throughput, and authentication error rates for each architecture, we use the Apache JMeter and Locust load testing frameworks to characterize per-component latency and concurrency behavior. We then combine these measurements with a queueing model; end-to-end validation against live deployments is identified as future work (Section VI). According to our estimates, traditional RBAC-based policy engines retain a mean latency of less than 15 ms up to about 1,000 concurrent users, deteriorate to 28.4 ms at 5,000 users, and become bottlenecked at 382.6 ms at full load (10,000 users). The authentication mechanism using deep learning technology exhibits an exponential relationship between users and latency due to neural network processing, with 718.7 ms consumed by 10,000 users. But in blockchain technology, there is no centralized trust issue, though latency occurs due to cryptographic processing, which can take up to 1,872 ms at 10,000 concurrent users. This paper provides quantifiable, model-based limits on architectural decisions in enterprise deployments and uncovers computational limits that lead to inadvertent denial-of-service (DoS) attacks under stress. We argue that scaling profiles of identity and access management (IAM) should be considered an important architectural decision alongside cryptographic correctness in deploying zero trust architectures (ZTA).