Export Control Proxy Team
The scariest part of any access-control rollout is the moment enforcement goes live and something you didn’t anticipate gets blocked: a CI service account routing through an unexpected region, a contractor whose location data is stale, a rule that’s broader than intended. So every new system starts in audit-only mode by default. Identity and location are resolved, rules are evaluated, and the outcome is logged, but nothing is blocked.
That gives you a real dataset to review before enforcement means anything: the country distribution for the actual traffic hitting that system, including cases you’d never have thought to test for. Once that data looks right, the system gets flipped to enforcing individually. Other systems stay wherever they are in the rollout. There’s no all-or-nothing switch.
The same audit-only-first approach applies to rule changes on the admin side. A rule can be reviewed against the audit log’s decision history before it’s relied on to deny anything. And if a dependency fails outright, say the Location Service is unreachable or an identity adapter errors, the proxy fails open by default, unless that specific resource has been configured to fail closed instead. Either way, the event is logged distinctly from a normal allow. The goal throughout is the same: enforcement should never become a bigger outage than the risk it’s there to manage.
