A design review for the city’s first GBP rollout debates starting with dozens of hyper-granular groups versus a few coarse groups refined over time. Which approach is more practical?
Select an answer to reveal the explanation.
Short Explanation
Launch day is a sketch, not a museum catalog. A handful of clear clubs—users, servers, cameras—beats 400 empty micro-groups nobody can operate. Refine once the city is actually using the badges.
Full Explanation
When a design review for the city’s first GBP rollout debates starting with dozens of hyper-granular groups versus a few coarse groups refined over time, the more practical approach is to start with a small number of coarse groups and refine membership and policy incrementally. A limited initial taxonomy with clear intent—for example cameras, printers, employee devices, and finance—lets operators deliver useful east-west controls without drowning in mis-tags before dependencies are understood. Creating one unique group per virtual machine on day one before any policy exists maximizes operational burden and error surface with little early value. Disabling GBP until every possible pair of endpoints has a custom ACL abandons group scaling and recreates the sprawl GBP was meant to avoid. Mapping each underlay interface to its own GBP group with no workload identity ignores application roles and produces unstable policy as devices move. Exam caveat: favor iterative, coarse-to-fine GBP onboarding for municipal fabrics over day-one hyper-granularity. Operational check: define five or fewer initial civic groups, implement a short allow list aligned to known application flows, measure unauthorized east-west reduction for two weeks, then split groups only where audit or incident evidence shows residual risk that coarse groups cannot address.