A plant manager refuses to sign any firewall rule deletion. How do you still retire reach an intruder could inherit?

## Understand the refusal before you try to move it The plant manager's incentives are clean and public: an unplanned line stop costs a measurable amount per hour, it is attributed instantly, and it is his. Your risk is unmeasured, undated and belongs to nobody in particular. If you go back with the same request and a better slide deck, he refuses again and you have spent your credibility. Every technique below works by changing the shape of the decision, not by arguing harder about the same one. ## 1. Make the action reversible, and let him set the clock Most rulebases support disabling a rule without removing it. That converts "delete" into "stop enforcing for a period, with the line intact and a one-step restore". Then negotiate the three things he actually cares about: - **When.** He picks the window. The strongest slot is the start of a shutdown or turnaround: the line is already down, engineering and vendors are on site and exercising exactly the rare flows you are worried about, and anything that breaks breaks in front of people who can identify it. - **How fast it comes back.** Commit to a rollback time and rehearse it. "Restored within ten minutes of a phone call" is a number he can plan around. - **Who is watching.** Somebody named, reachable, on shift for the duration. A reversible change with an owner and a rollback is a fundamentally different ask from a permanent deletion, and it is the single change that most often unlocks a refusal. ## 2. Invert the default with a claim exercise Today the default is silence: nobody has to do anything for a rule to survive. Publish the unowned list — each entry stating source, destination, ports, hit evidence and counter epoch in plain language — and ask teams to **claim** the rules they need by a date, after which unclaimed rules are disabled on the reversible terms above. This does not remove his veto; he can claim anything he wants. What it removes is the ability of the whole organisation to keep a grant alive by not answering emails. It also produces the thing you actually want more than deletions: named owners. ## 3. Narrow when you cannot remove A rule that permits `enterprise` to `plant-servers`, any port, is a different object from one permitting three source hosts to one destination on one port. Narrowing is a much smaller ask — the flow keeps working by construction if you narrow to what is genuinely in use — and it removes most of the reach. If he will not let you delete, ask what he will let you shrink. A rulebase of the same length with a tenth of the reach is a real security outcome, even though it makes no progress on any rule-count metric. ## 4. Price the exposure in his language "Legacy rule, no owner, zero hits" is invisible to him. "Any laptop on the enterprise network can open any port on the line-control historian, and nothing is watching that path" is not. Translate each surviving permit into what somebody who got onto the office network could do to his plant. That is the only version of the risk he is equipped to weigh against a production stop, and some of the rules he was defending stop being worth defending once he can see them. ## 5. Escalate the split, not the person The structural problem is that the veto and the exposure sit with different people. He can refuse; he does not carry the consequence of refusing. That is not a fight to have with him — it is a decision that belongs to whoever owns both sides: the site director, the operations risk committee, whoever signs for both plant availability and plant security. Bring them a short list, the reach each item grants, what you propose, and what you need decided. Do not bring a request for an override; bring a request for an owner. ## 6. Accept the residual honestly If, after all this, some rules stay, that is a legitimate outcome — provided they are now a dated, itemised, signed acceptance rather than sediment. The failure state is not "rules remained". The failure state is that nobody chose them and nobody knows they exist. Converting silent decay into an owned decision is most of the value; the deletions are the remainder. ## What interviewers listen for Candidates who have not done this argue about the technical case. Candidates who have done it talk about reversibility, timing, who is on shift, who claims, who signs, and what happens to the rules that survive. The test is whether you can make progress against a refusal you cannot overrule — and whether you know that shrinking reach counts even when the rule count does not move.