A water-utility OT historian VM must reach a jump box and must never traverse citizen Wi-Fi. What should the administrator do first when grouping that conversation?

A water-utility OT historian VM that must reach a jump box and must never traverse citizen Wi-Fi should first be identified as a restricted east-west pair and grouped only for those two workloads under deny-except-allow policy. That conversation is a private hallway between two locked plant rooms: label the pair, put only those objects in the groups, and keep guest or citizen SSIDs entirely out of the path. Publishing the historian on the guest SSID so field crews can browse it fails by concept because citizen Wi-Fi is an untrusted access network and publishing OT historian data there expands exposure far beyond a controlled jump-box path. Classifying the conversation as north-south SaaS because the jump box uses HTTPS fails because HTTPS on a jump box does not make an east-west overlay or datacenter pair into SaaS north-south; protocol choice is not traffic-direction classification. Moving the historian onto an internet Edge VIP so Gateway Firewall can NAT it fails because internet publication of OT historian systems violates the isolation intent and invents a north-south exposure that the requirement explicitly forbids. Exam caveat: restricted OT east-west pairs are grouped narrowly with deny-except-allow; do not publish OT onto guest Wi-Fi, rebadge them as SaaS, or NAT them to internet VIPs. Operational check: create groups containing only the historian and jump box, enforce allow for the required services and deny other sources including guest Wi-Fi, Traceflow the pair, attempt access from a citizen SSID and confirm deny, and record the pair in the utility OT segmentation inventory.