uence is activated. Strict security mechanisms and the testing and validation executed on policies before policies are introduced into the ONAP ecosystem will reduce the risk of "bad" policies reaching the network. However, given the tremendous impact that policies will have, we want to ensure that we introduce additional safety mechanisms for active policies-just in case. If VM unresponsive then Reboot VM FIGURE 15.4 Simple control loop policy, rebooting a VM. If VM unresponsive then Reboot VM If VM unresponsive and restart fail Rebuild VM If VM unresponsive and rebuild fail Ticket (human intervention) FIGURE 15.5 Multistep control loop policy. Network Operations During runtime, guard rails limit the potential impact of inappropriate policies. As an anal- ogy, guard rails on mountain highways are placed at the edge of the highway to provide protec- tion against cars catapulting off the edge of a cliff. Under normal conditions, cars should not hit the guard rails. However, should a car spin out of control and hit the guard rail, the guard rail is designed to prevent a catastrophic outcome. Policy guard rails are similar; they are essentially over- riding policies, which when they detect a violation of an invariant condition (a condition that should always be true), prevent further relevant actions from being taken. As a concrete example, consider an invariant that states that at least 80% of all network interfaces must be up and operational at all times. If this invariant is violated (too many network interfaces have been shut down), then all control loop actions that involve shutting down interfaces should be overridden, and the interface shut downs prevented. A guard rail such as this would prevent a "bad" policy from shutting down the network-something which a policy as simple as that in Figure 15.6 would achieve if the appropriate guard rails were not in place. Designing effective guard rails requires appropriate domain knowledge and operational experi- ence regarding the type of conditions that can arise. Th