It would be helpful to extend the existing policy syntax with a non-rule action at each interaction point, like a default behavior if no specific rule is matched. This could be similar to the existing policy_action_on_fail for a single rule, but something like default_action with options to "delete_bundle" or "do_nothing".
Without this, it is too easy to pass unsecured traffic through each associated interaction point.
It would be helpful to extend the existing policy syntax with a non-rule action at each interaction point, like a default behavior if no specific rule is matched. This could be similar to the existing
policy_action_on_failfor a single rule, but something likedefault_actionwith options to "delete_bundle" or "do_nothing".Without this, it is too easy to pass unsecured traffic through each associated interaction point.