Guided Policy Composer

The Guided Policy Composer lets an authorized engineer express an industrial access requirement step by step. Reviewed rules from the library are selected and combined; the customer does not have to begin with an empty technical configuration.

Six customer questions

Step	Question	Example
1. Who	Which authenticated VPN user does this policy serve?	Transformer-service engineer
2. From Where	Which approved source context is recognized?	Assigned access domain or engineering path
3. When	When may the policy be used?	Approved operating period or continuous access where required
4. To What	Which equipment or endpoint is in scope?	TR1 transformer controller
5. Industrial Operations	Which observations or commands are permitted?	Read loading and temperature; request one valid tap movement
6. Enforcement	What happens on a match or violation?	Accept and record permitted reads; block and record invalid commands

Figure — Guided Policy Composer follows the same intent-to-enforcement lifecycle.

With L2Proxy Connect, the authenticated user and live session become native decision context. With standalone enforcement, the approved isolated access path provides the deployment boundary. The same industrial intent can therefore be applied using the enforcement model selected for the site.

The completed result includes the policy name, description, evaluation order, enabled state, decision, event-recording behavior, and whether evaluation should continue after a match.

Reuse of reviewed industrial knowledge

The Composer draws from managed rule templates and the Industrial Equipment Library. This allows a policy to use established knowledge such as:

• the identity and role of a feeder breaker, relay, transformer, regulator, or DER intertie;
• point meanings such as breaker status, Remote/Local, lockout 86, winding temperature, tap feedback, or control command;
• approved source and destination identities;
• safe measurement bands and setpoint ranges;
• permitted Open, Close, Pulse, Reset, Acknowledge, or setpoint operations;
• Select-Before-Operate and other equipment-specific prerequisites.

If a required condition is not yet in the library, the guided rule-authoring capability provides searchable help and completion for the available protocol helpers. The new rule can then become reviewed reusable content rather than a one-off entry.

Worked example: transformer maintenance access

Requirement: an authenticated transformer-service engineer may inspect TR1 and make an approved OLTC request, but may not send a value outside the transformer's reviewed tap range.

Composer step	Selected intent
Who	The assigned transformer-service VPN user
From Where	The user's approved access domain or isolated access context
When	The approved maintenance access period
To What	TR1 transformer control endpoint
Industrial Operations	Read loading, temperature, and actual tap position; request tap positions 1–17 using the approved sequence
Enforcement	Record permitted activity; block and record an invalid or incorrectly sequenced tap request

The result is understandable to operations, protection engineering, and OT security. It can be revised as a managed policy and added to the user's final Policy Profile.

Generated and customized policies

For standard cases, the system generates the complete L2Proxy policy from selected, reviewed building blocks. Advanced users can customize the generated definition when a special operating requirement demands it. The system identifies whether the stored policy is generated or customized so the distinction remains visible during review.

Policy review information

Before adding a policy to a Policy Profile, reviewers can inspect:

• policy identity and description;
• assigned user and access context;
• source, destination, and industrial-operation rule parts;
• enforcement decision and event-recording behavior;
• enabled state and evaluation order;
• generated or customized status;
• current revision and update time.

Next: Policy Profile Composition.