To build an effective Security Policy, use a ________ and _______ rule.