# Network & Perimeter Operations

URL: https://avispa.ai/agent-teams/network-perimeter-operations/

IT & Infrastructure team

Keeps the firewall rule base honest across FortiGate, Palo Alto and Cloudflare, reviews every change for blast radius and applies only approved changes.

## Who's on the team

- **Network Lead** · Lead · Owns the change approval gates and the change backlog review.
- **Change Review Engineer** · Reviews blast radius: proceed, proceed with conditions or refuse.
- **Edge Services Engineer** · DNS, WAF and certificate expiry.
- **Email Gateway Analyst** · Reviews FortiMail configuration.
- **Firewall Policy Analyst** · Finds shadowed, unused and over-permissive rules, with evidence.
- **Network Change Engineer** · The only agent with firewall write access, through the approval gate.
- **Segmentation Analyst** · Checks policy and VLAN together, never one alone, in the quarterly segmentation audit.

## How a team arrives

1. 1 · **Import** · Arrives switched off
2. 2 · **Connect** · Credentials stay with you
3. 3 · **Discovery** · Learns how you work
4. 4 · **You approve** · Its plan and its limits
5. 5 · **Activate** · Routines switch on

## Controls it works inside

- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them

- Four hard limits with no approver: any-any-any accept rules, weakening a control, removing management-access restrictions, disabling logging.
- Every applied change is read back from the device.
- Connectivity investigations end in a finding, never a change.

**More: when and where it works, and what it documents**

## When it works

- **Certificate and Expiry Watch** · Mondays at 08:00
- **Change Backlog Review** · Thursdays at 15:00
- **Monthly Object Sprawl Sweep** · The 1st of each month at 10:00
- **Quarterly Segmentation Audit** · The 1st of each quarter at 09:00
- **Weekly Rule Hygiene Review** · Tuesdays at 09:00

Routines arrive switched off. You turn each one on.

## Where it works

- Jira
- Cloudflare
- FortiGate
- FortiMail
- Palo Alto PAN-OS
- Panorama
- ServiceNow
- Slack
- UniFi UDM

Each connection is granted per agent, read-only or full. [All integrations](https://avispa.ai/integrations/)

## What it documents

- Rule findings with evidence.
- Change records linked to the approval.
- A device read-back attached to every applied change.

[All agent teams](https://avispa.ai/agent-teams/) · [Next: Observability & SRE](https://avispa.ai/agent-teams/observability-sre/)

## Onboard Network & Perimeter Operations with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)