Zone Policy
The Zone Policy factor scores a flow using the policy from the zone matrix. The matrix says whether traffic between two zones should be allowed, reviewed or denied, and this factor turns that policy into risk points.
Default max contribution: 20 points.
Scoring table
| Zone Policy | Points (default cap 20) | Meaning |
|---|---|---|
| Allow | 0 | Expected, baseline traffic |
| Review | 10 | Needs scrutiny before approval |
| Deny | 20 (max) | Blocked by zone matrix policy |
| No zone match | 5 | The source or destination is not entirely inside any zone subnet, so no zone-to-zone policy applies |
| No zone matrix active | 5 | No zone has a subnet, so zone analysis is off |
Custom caps (CLI)
The web app always uses the default cap of 20. With a custom zoneMax in a CLI --config file, every row scales in proportion, rounded to the nearest point: points × zoneMax ÷ 20. Deny always scores the full cap.
zoneMax | Allow | Review | Deny | No zone match / no matrix |
|---|---|---|---|---|
| 20 (default) | 0 | 10 | 20 | 5 |
| 40 | 0 | 20 | 40 | 10 |
| 10 | 0 | 5 | 10 | 3 |
| 5 | 0 | 3 | 5 | 1 |
How it works
Each side of the flow (source and destination) is matched to a zone separately:
- Containment. A side belongs to a zone only if its whole address range lies inside one of that zone's subnets. A single host must be inside the subnet. A CIDR such as
10.0.0.0/8must fit completely, so it does not match a zone that only has10.1.0.0/16. - Longest prefix wins. If several subnets contain the range, the most specific one (the longest prefix) decides the zone.
any/0.0.0.0/0is only contained by a0.0.0.0/0zone subnet.
If both sides resolve to a zone, the matrix cell for that pair supplies the policy, and that policy sets the points above.
If either side is not entirely inside any zone subnet, the result is No zone match (5 points). Typical cases are an external address with no 0.0.0.0/0 zone, or a CIDR that spans two zones, such as 10.0.0.0/15 when 10.0.0.0/16 and 10.1.0.0/16 belong to different zones. No zone-to-zone policy applies in that case, even if the other side matched a zone, so no floor is applied either. The result badges show the unmatched side as Undefined.
No zone matrix active (5 points) applies when no zone has any subnet. That includes having no zones at all, or only zones without subnets. Without zones the score still gets a small baseline nudge, but environments that have not set up zones are not penalised.
The browser and the CLI (--config with zones) use the same matching code, so the same flow and zone setup always produce the same zone, policy and points.
Interaction with floors
The Zone Policy factor feeds into the floor system, but only when both sides matched a zone:
- A Deny policy raises the final score to at least the start of the High tier (51 with the default thresholds).
- A Review policy raises it to at least the start of the Medium tier (26 by default).
These floors apply whatever the other three factors produce. No zone match and No zone matrix active never trigger a floor.