The network team has well-established procedures to follow for creating new rules on the firewall. This includes having approval from a manager prior to implementing any new rules. While reviewing the

Documenting the reason after the fact does not remediate the policy violation or remove the potential security risk introduced by the unapproved rule.

Monitoring traffic through an unapproved rule allows an unauthorized configuration to remain active, which continues to violate change management policy and may expose the network to additional risk.

Leaving the rule active on the assumption that the business relies on it circumvents the approval process and rewards bypassing established change controls, creating a precedent for future violations.

Immediately rolling back the unauthorized rule enforces the change management policy and removes a potentially risky configuration that bypassed required approval controls. This action preserves the integrity of the change control process and eliminates any security exposure introduced by the unapproved rule. The rule can be re-implemented correctly once manager approval is granted and the change is properly documented.