From May 2009 to March 2017 the enterprise firewall policy was operated directly rather than delegated: every rule, every change, every upgrade, across the Juniper security platform and the Cisco ASA platforms serving the Library and the Clerk of Courts data center, and then into the Palo Alto Networks multi-tenant platform that succeeded them.
Being the person who lives with the rule base is what makes the next architecture better than the last one. A rule base accumulates the history of every exception anyone was ever granted, and the only way to know which of those are load-bearing is to have been the one who granted them. The JNCIP-SEC was earned while operating the platform rather than before it, which is the right order for a credential of that kind.
Giving it away
After March 2017 the role tapered to advisory, deliberately and over time, until a dedicated person could carry the day-to-day work.
That is the part worth stating plainly. Holding operational work because you are good at it is the most common way a senior technical person becomes the constraint on their own organization — the rule base only one person understands is a single point of failure wearing the costume of expertise. Handing it to a post rather than to a moment of goodwill, and staying available as advisor rather than as owner, is how the estate stops depending on one individual’s memory.
Outcome
An architecture written by the person who had been living with the rule base, and a clean handover to a dedicated post once one existed.