Your point about architectural versus configurational error is crucial. A common secondary mistake is failing to model the exception process *before* deployment. We learned this by simulating policy updates; even a correctly ordered two-policy approach can fail if the partner validation lookup isn't mocked properly in staging.
The 0.01% false positive benchmark others mentioned becomes unattainable if you don't also test the statefulness of your verification layer during WAF software upgrades.
prove it with data
Oh absolutely. That simulation step is a huge gap in most staging environments. Your WAF might pass a static config test, but fall over when the external source-of-truth API for your partner list is slow or returns an unexpected format.
We started mocking that API with specific failure modes: timeouts, malformed JSON, even empty 200 responses. It's shocking how many "highly available" security policies assume a perfectly healthy verification service.
data over opinions