How does a remediated contractor laptop leave NAC quarantine without a link bounce, and what does the deadline override hand an intruder?

## Designing the exit before enforcement day Every estate designs the entrance to quarantine carefully and the exit not at all. The entrance is a decision the policy server makes; the exit needs a *second* decision, triggered by something, and if nothing triggers it the device stays until somebody intervenes. Interviewers ask this because 'how does a device ever leave?' is the question that stalls real rollouts. ## The mechanism A session's authorization is not fixed for its lifetime. The policy server can send a change-of-authorization to the network device holding the session, and that message either replaces the authorization attributes or forces the session to re-authenticate. That is the clean exit: the device is re-evaluated, now passes, and its restricted authorization is swapped for its normal one while the session continues. What has to happen for that message to be sent is the part candidates skip. Something must know the device is fixed: - the health agent re-evaluates after remediation and reports the new state, which is the smooth path and requires an agent you control; - a re-authentication timer expires and the whole decision is retaken, which is the crude path and can leave a fixed device waiting out the interval; - an operator triggers it by hand, which is not a design, but is what most estates do on day one. ## What the exit costs, per enforcement form If quarantine was a per-session filter, the swap is genuinely invisible: the address does not change, the link does not drop, the user notices nothing. If quarantine was a VLAN, leaving is another subnet change, so the endpoint has to re-address and the exit costs the same bounce the entrance did. That asymmetry is a legitimate reason to prefer per-session filtering on an estate where devices cycle in and out of quarantine often. ## The partner floor, where none of it applies On a joint-venture project floor, the devices belong to the partner firm. You cannot dictate their build, you often cannot require your health agent on them, and their updates come from the partner's own service, which is not on your network. So: the device fails a check you cannot enforce upstream, lands in a segment that must now also reach an external update source, remediates against something you cannot observe, and produces no completion signal your policy server understands. There is no automatic exit because there is no reporter. What is left is a human. ## The override, and why it is the interesting half The override is real and it is not rare: a contractor has a deadline, the engineer on shift moves the port into a production authorization profile, and the ticket is closed. Look at what that actually created. A device whose health was never confirmed is now in production. The exception has no expiry, because the pressure that produced it was a date, not a policy. It has no owner after the shift ends. Nothing will re-check it, since the re-check that would have caught it is exactly the mechanism that has just been bypassed. And it is repeatable — the same laptop takes the same route next quarter, because the process worked last time. An adversary does not need to defeat the control to use this. Being placed in quarantine is a choice available to whoever holds the device; escalating a deadline is a choice available to whoever holds the relationship. The control is then not defeated but *routed around by the organisation that owns it*, which is why the exception path deserves as much design as the enforcement path. ## What a good answer proposes Make the override a first-class object rather than an act: it grants a defined, limited profile — not full production — for a fixed period; it records who granted it and against which ticket; it expires automatically so the device returns to evaluation without anybody remembering; and it generates a visible record so that a repeat pattern for one device or one team is noticeable rather than invisible. Then commit to something falsifiable before enforcement day: what proportion of exits are expected to be automatic, how long the median device sits in quarantine, and how many active overrides are tolerable at once. Those three numbers are what turn 'we have NAC' into a claim you can defend when somebody asks whether the boundary actually holds.