policy "public-web" {
  when request.path matches protected_api
  and  client.behavior exceeds baseline

  if threat.layer == network
    route -> scrubbing_cluster
  else if threat.layer == application
    action -> challenge | block
  else
    action -> accelerate
}