A WAF rule is the only thing between attackers and an unconfirmed bug in a partner's code, with no owner or expiry — how do you resolve that?

## Why this is not an engineering deadlock Every technical route out of this has already been tried by the time it reaches you. There is no archived sample, or no build to test against, or the supplier will not schedule a retest for a bug they consider closed. What remains is a decision, and decisions stall for organisational reasons: the person who could delete the rule carries the downside alone, and gains nothing. So the correct move is to stop pursuing the deletion and start forcing an explicit choice between named, priced options. All three of them are acceptable outcomes. Only the fourth — nothing changes and nobody decides — is not. ## Option 1: own it deliberately The cheapest, most under-used outcome is to keep the rule and make it a real control: a named owner, a written statement of what it covers and what it plainly does not, a review date, and the deletion criterion written down for the first time. This costs a few hours and it converts an artefact into a decision. It also stops the quiet lie in the control inventory, where a rule with no owner and no test is counted as mitigating a risk that nobody has confirmed it still mitigates. That claim is the part an auditor can actually break, and it is the part you cannot defend. ## Option 2: fix the contract, not the rule The reason the evidence is unobtainable is commercial. A supplier who ships code into your extranet should owe you, when they assert a security fix: the affected version range, a reproducible test case, and an instance you may test against. None of that is exotic, and none of it exists unless somebody put it in the agreement. Escalating this as a contract gap does two things a technical escalation cannot. It moves the cost to the party who created it, and it fixes the *next* stopgap as well as this one. Expect to pay for it — a supplier will price a test environment — and expect to be asked whether the rule is not cheaper. The honest answer is that the rule is cheaper this year and unbounded after that, because it accumulates and nothing ever removes it. ## Option 3: change the exposure instead If neither the evidence nor the contract is reachable, the remaining lever is the estate. Move the partner off the legacy virtual host onto a maintained one; put the application behind a narrower interface; reduce who can reach the route at all. This is usually the most expensive option and it is the one that actually ends the problem, because it retires the position the rule was defending rather than the rule. ## Getting the decision made Put it to whoever owns the partner relationship — not to the security team, which cannot accept business risk, and not to the engineer who inherited the rulebase, who has no authority to. What that person needs from you is short and specific: - what the rule blocks, in one sentence, and what it demonstrably does not; - what would have to be true to remove it, and why that is currently unobtainable; - the three options with their costs and who pays each; - a recommendation, because a decision-maker handed three options and no view will choose none of them; - an expiry on whatever they accept. The expiry is the part people drop and it is the whole mechanism. Risk acceptance without a date is not acceptance, it is deferral, and deferral is how the rule got to five years old in the first place. ## The failure modes to name out loud **Deleting because it is untestable.** An engineer frustrated by the deadlock removes the rule quietly. If the bug is live and reachable, that is an unforced exposure, and it is unattributable later because nothing was written down. **Leaving it unowned and calling that safe.** It is not safe; the platform, the route and the partner's client all change underneath it, and an inert rule that everyone believes is protecting something is worse than no rule, because it displaces the fix. **Turning it into a programme.** A generic rule-lifecycle initiative is a way of not deciding about this rule. Decide about this rule, on this virtual host, with this supplier, this quarter; the programme can follow from a decision that was actually made. ## What good looks like a year later The rule is either gone with a written closure record, or present with an owner, a review date, a statement of coverage and a dated risk acceptance — and the supplier agreement now says what arrives with a security fix. Nothing about that requires the deadlock to have been broken technically. It required somebody to be asked a question they could actually answer.