A food distributor wants three outcomes on the plant floor: laptops with current antivirus and the host firewall enabled get full access, laptops missing either one get access only to a patch server, and personal devices where no assessment agent can run get access to the update service until an admin reviews them. Which posture design maps these three results correctly?

The posture service evaluates requirements on the endpoint, such as an antivirus definition check, a service check and a firewall check, and returns one of three results: compliant when every required check passes, non-compliant when a check fails, and unknown when ISE has no completed posture result, often because no agent is installed or running. Authorization rules match those results independently, so each result carries its own profile: full access for compliant, patch-server access for non-compliant, update-service access for unknown. Collapsing the model to two results forces you to place unassessed personal devices somewhere, and folding them into non-compliant grants only the patch server, not the update service the third requirement expects. Using MAB profiling to detect non-compliant devices misreads what profiling does, since it identifies what a device is rather than the state of the software on it, so a laptop with antivirus switched off still profiles as a Windows workstation. Routing every unknown endpoint to a quarantine VLAN contains the device but withholds the update service until a sponsor intervenes. Exam caveat: results appear only once the agent reports, so an endpoint can sit briefly in unknown after boot. Practical check: disable antivirus on a test laptop and watch the result change in Live Sessions.