Showcase: Our zero-trust rules for the finance department's apps.

Hey everyone, been lurking here for a bit while we evaluated SDP/ZTN solutions. We're a mid-sized SaaS company and just finished rolling out Perimeter 81, specifically for our finance team. They were the obvious first candidate given the data they handle.

I wanted to share the core rules we set up for their access, partly to see if this aligns with others' approaches and partly to get feedback. We're trying to be pragmatic—secure but not to the point it kills productivity.

Our finance team primarily uses:
* NetSuite
* Bill.com
* Salesforce (for quotes/orders)
* An internal reporting portal (hosted on AWS)

Here’s the zero-trust logic we implemented:

**Access Rules:**
* **Device Posture:** Corporate-managed device (Intune) OR a compliant personal device (specific OS versions, disk encryption, screen lock) is required. No exceptions.
* **User Context:** Access is only granted if the user is in the "Finance" Okta group. We also tied it to a specific geographic region (our HQ state) as an extra layer, though we're debating if this is overkill for potential travel.
* **Application Specificity:** Each app has its own micro-tunnel. No "all-access" network. The Bill.com tunnel only talks to Bill.com, etc.
* **Time Restrictions:** The internal reporting portal access is cut off after 6 PM and on weekends, which the team actually requested to avoid burnout.

**Our biggest debate was around Salesforce.** Finance needs it, but so does everyone else. We ended up creating a separate, more restrictive "Finance_SF" app segment that only exposes the specific objects and records they need, rather than the full org.

So far, the main gripe is the occasional need to re-authenticate, but the team says the trade-off for feeling more secure is worth it. I'm curious:

* Has anyone else built similar department-specific rules?
* For those using P81, how granular do you get with app segmentation? Is our separate Salesforce segment over-engineering it?
* Any pitfalls we should watch for as we expand this to our engineering department?