One inspection stack serves ten tenants: what does your unclassified-traffic rule say, who signs for it, and what hides behind an allow?

## Why this is not a technical decision The unclassified-traffic rule decides what happens to traffic nobody can name. Whichever way it points, somebody bears a consequence they did not choose: with allow, a customer carries a risk they were never quoted; with deny, a customer carries an outage in an application the provider has never heard of. That makes it a **risk acceptance**, and a provider cannot accept risk on a customer's behalf. Getting this right is mostly about finding the person who can sign, and giving them something worth signing. ## The three options, priced **Global allow.** Costs nothing to run and breaks nothing. What it buys the adversary is precise: anything with a bespoke protocol lands in this bucket automatically, so the rule is a hole shaped exactly like a purpose-built channel — and one hole shared by every tenant on the stack. It is also invisible: nothing alerts, the bucket simply grows, and nobody reads it. **Global deny.** A defensible posture, and it will drop applications you cannot enumerate because you do not own any tenant's inventory. The failures arrive as "the transfer to our partner stopped working", days later, from people who did not know a classification engine sat in the path. On a shared boundary the blast radius is every tenant simultaneously, which is the worst property a change can have. **Per-tenant defaults.** The correct answer and the expensive one: a policy set per tenant, an owner per tenant, and a review that recurs. Be ready to say the cost out loud, because a principal answer that pretends the right thing is free is not credible. ## Sequencing, which is most of the real answer 1. **New tenants start at deny.** Onboarding is the only moment where somebody on the customer side is actively testing and expects things to break. A deny introduced during acceptance costs a conversation; the same deny introduced two years later costs an incident. 2. **Existing tenants get a log-only phase first.** Run the deny in report mode and produce, per tenant, the list of endpoint pairs and volumes it *would* have dropped. This is the artefact that makes the conversation possible: it converts "we would like to tighten a rule" into "here are the eleven flows this affects, do you recognise them?" 3. **Work the list down before enforcement.** Each recognised flow becomes a scoped definition or an allow keyed to that endpoint pair — never a blanket allow — with an owner and a review date. 4. **Migrate on a date the tenant agreed**, with a rollback that is one change and can be made by whoever is on call, because the first enforcement window is when you discover what the log-only phase missed. 5. **Whatever is left at the deadline is signed for.** A tenant who wants allow-unclassified keeps it as a written, dated, expiring exception against their name, not as the platform's default. ## Who signs, and what you own The tenant's named security contact signs the risk. The provider owns the **evidence and the reporting**, not the decision: what is in the bucket, how it changed, what a deny would drop, when the exception expires. That split is what keeps the arrangement honest — it means a provider is never in the position of having quietly chosen a customer's posture for them, and it means a tenant who declines to engage still has a dated record of having been asked. If no tenant will engage at all, that is a gap in the service description rather than an engineering failure, and it should be escalated as one. The worst outcome is the common one: the default was set years ago by whoever built the stack, nobody has a name against it, and the bucket has been growing ever since with no reader. ## The tell of a weak answer Picking deny and calling it best practice, with no mention of who absorbs the breakage, no rollout order and no rollback. The security posture is the easy half. The half that is actually being tested is whether you can impose it on ten organisations who never agreed to it, and know which of those ten can say no.