Determining security actions at policy-enforcement points using metadata representing a security chain for a data flow

A computing apparatus comprising:

• a processor;
• a memory storing instructions that, when executed by the processor, configure the computing apparatus to:
• receive, at a first policy-enforcement point, a data flow comprising data packets and metadata, wherein the metadata comprises one or more cryptographically verifiable attestations of the one or more security operations, the one or more cryptographically verifiable attestations being generated by one or more upstream policy-enforcement points and accompanying the data packets with the data flow;
• determine, based on the metadata, which security operations have been performed on which of the data packets of the data flow to generate a determination result including verifying the one or more cryptographically verifiable attestations;
• and
• apply, based on the determination result, one or more security actions to the data flow,
• wherein the one or more security actions comprise performing an additional security operation on a first subset of data packets that require the additional security operation and dropping at least one remaining data packet that also requires the additional security operation, the performing and dropping being based on available processing resources at the first policy-enforcement point.