Hi @scareything , thanks for your support
I ended up writing a intercept config for my ssh severs, one for postgres servers and one for apache servers but just one host config with 4 port ranges for ports: 22, 5432 80 y 443, this is because as you suggest be able to delimit clients to access the services by a role attribute in service policies, so when a client wants to connect the target is is server240.ziti, server241.ziti, and depending on the tcp port, it uses routes to the correct endpoint, and the best of all, with just one identity per server. That's amazing.
Thanks again for your help.