AI-based Zero Trust evolution model that goes beyond the limitations of ClearPass policy visibility

When discussing Network Access Control (NAC), the core gateway to enterprise network security, HPE Aruba Networking's ClearPass Policy Manager (CPPM) is considered the most powerful and flexible policy engine currently available. This is because it can implement sophisticated access control by combining almost every conceivable context, such as endpoint profiling information, AD groups, access times, locations, and security status.

However, behind this overwhelming flexibility lies a chronic pain point that all ClearPass operators share.
It is precisely the ‘complex policy structure that must be assembled from the bottom up and the fragmentation of UX.'.

1. ClearPass Operator's Dilemma: Why Is It Difficult to Understand Policies at a Glance?

Let's consider the configuration sequence an administrator must follow to fully create a single new authentication service in ClearPass.
What we ultimately aim to create is a “service that grants appropriate permissions (VLAN, ACL, etc.) when a specific user connects,” but the actual work in the GUI proceeds strictly in reverse order (Bottom-Up).

The ‘policy maze’ created by a Lego-block-style structure’

이 Lego block (modular) architectureIt is an excellent design in terms of object reusability.

This is because an Enforcement Profile or Role Mapping policy created once can be reused across multiple services.
However, as the operation period exceeds one or three years and the number of services increases to dozens, this advantage immediately The disaster of visibilityIt turns into.

1. Context Switching Fatigue: To follow the policy flow to see why a specific user was moved to an isolated VLAN Service Open the tab, note the connected policy name, and, Role Mapping Go to the menu, check the conditional statement, and then again Enforcement Policy와 Profile You have to open three or four pop-up windows while switching between menus.
2. Absence of Reverse Tracking: “If I change the VLAN number of this Enforcement Profile, which other wired/wireless/VPN services sharing this profile will be affected?” In the default ClearPass GUI, it is very difficult to trace back which parent policy and service a child object is tied to.
3. The Flood of Orphan ObjectsA situation arises where hundreds of Roles and Profiles created by the previous person in charge for testing accumulate without being deleted, but they cannot be removed out of fear that they might be being used somewhere in the operational service.

at last A visibility tool that weaves fragmented policy blocks together to display a single complete blueprint.It becomes desperate.
And a new community project recently created by an HPE Networking engineer is scratching exactly that itch.

2. The Arrival of a Relief Pitcher: ClearPass Policy Visualizer (CPV) Architecture Analysis

ariyaparsa-dev/clearpass-policy-visualiseris an open-source web application developed based on Python Flask.
The previously mentioned 5-step assembly structure of ClearPass Single interactive graph와 Impact Analysis ReportIt visualizes it instantly.

The key point is that it is not merely a static viewer that dumps and displays configuration files (XML) offline, but operates in real-time in conjunction with an actual production ClearPass cluster.

Why were three protocols combined simultaneously?

If you dig into the codebase of this repository, you can see the designer's deep understanding of the ClearPass architecture.
CPV combined ClearPass's three interfaces into a hybrid to eliminate performance bottlenecks.

The data collected in this way cp_cache.py와 cp_object_graph.pyIt is normalized into an In-Memory Object Graph per environment (supports up to 3 multi-clusters such as Prod, Test, Dev, etc.).

3. How to Utilize CPV 200% in Practical Operations

Launch CPV as a container (Docker Compose) and the initial onboarding wizard (cp_setup.pyIf you go through ), you will obtain three weapons that will solve the difficulties you have experienced while wandering through the GUI.

• End-to-end policy flow visualization (cp_graph.py): Service → Auth/Authz Sources → Role Mapping → Roles → Enforcement Policy → Enforcement ProfileIt displays the entire pipeline leading to it like a mind map on a single screen. It can be immediately extracted as SVG/PDF during security audits or handovers.

• Reverse Change Impact Analysis (cp_impact_analysis.py)Clicking a specific Role or Enforcement Profile node briefs you in a new tab report on all parent policies referencing that object and the list of ultimately affected Services. It is a safety mechanism that verifies the Blast Radius in 1 second prior to the operation.

• Clean unused orphan objects (cp_unused_objects.py)It helps with a safe policy database diet by automatically extracting Roles, Policies, and Profiles that have accumulated over the years but are not currently called by any service or higher-level policy.

4. One Step Further: Building Autonomous Zero Trust through CPV + AI Integration

Here, let's take technical imagination to the next level.

The biggest topic in the network security industry recently is the use of Agentic AI Zero Trust Operations Automationno see.
However, if you throw ClearPass’s raw API data or massive configuration files directly at the LLM, it will fail to understand complex reference relationships, exceeding token limits or causing severe hallucinations.

In this case, the ‘in-memory object graph‘ and 'SQL analysis module' already established by CPV become the most perfectly refined context layer for the AI agent.
CPV's Python modules MCP (Model Context Protocol) We introduce three innovative use cases that can be implemented when wrapped with a server or Function Calling tool.

Use Case ①: Natural Language-Based Policy Change Simulator (What-If Analyzer)

In a Zero Trust environment, policies are changed frequently to maintain the principle of least privilege.
CPV's cp_impact_analysis.py와 cp_role_references.pyConnecting it as a tool for an AI agent enables conversational pre-validation.

• Engineer Prompt: “I plan to modify an isolated VLAN profile mapped to ‘Contractor-Role” in the contract wireless service. Could there be any side effects on the wired 802.1X or VPN service?”
• How AI + CPV Works: After the AI agent calls CPV's reverse graph traversal function to receive the dependency tree as JSON, instead of a simple list, conditional statements(Tips: Role I will answer by interpreting the context of (etc.).
• result: “Since this profile is referenced not only wirelessly but also in the fourth condition rule of the ‘Branch-Wired-802.1X’ service, modifying it will also change the VLANs of the branch office's wired terminals. We recommend duplicating and applying a new wireless-only profile.”It provides a guide at the same level as...

Use Case ②: GraphRAG-based Zero Trust Security Auditing and Shadow Policy Detection

The biggest enemy of Zero Trust architecture is the ‘logical gap (Shadow Policy)’ hidden within the complex configuration.
CPV's cp_graph.pyThe Node and Edge topology data generated by LLM GraphRAG Inject into context, cp_insight_sql.pyCombines the hit count data.

AI Security Audit Scenario:

1. Detection of excessive authorization paths: “The authentication source is standard AD, but since the Role Mapping conditions are loosely configured, please find all logical paths where the final Allow-All profile for the entire internal network can be executed.”
2. Dead Policy AnalysisThe AI identifies structural errors where traffic cannot reach the granular security policies defined at the bottom because the matching conditions of the policies located at the top of the service order are too broad, by comparing graph traversal with actual Hit Count (0 cases) data.

Use Case ③: Autonomous Terminal Troubleshooting Agent (Access Tracker + CPV Combination)

The task that takes the most time in the field is tracking *”Why did a specific terminal fail to receive the intended role and end up in the Guest or Quarantine VLAN?”*.
CPV's PostgreSQL integration module (cp_endpoint_sql.py) and policy cache(cp_services.pyYou can automate this process by combining ).

• Engineer Prompt: “MAC address AA:BB:CC:11:22:33 ”This is an executive laptop, so please find out why it keeps dropping to Guest privileges."
• How AI + CPV Works:
  1. The agent cp_endpoint_sql.pyCall to immediately query the current profiling attributes (Device Category, OS Family, Custom Attributes, etc.) of the device from the DB.
  2. Next, the LLM compares the Role Mapping condition tree (Condition Rules) cached in the CPV with the actual attributes of the terminal in a 1:1 ratio (Diff).
• result: “The device in question was correctly classified as Windows for its OS attributes, but in the Endpoint Repository Corporate-Managed = True ”Custom attributes are missing. As a result, it failed to pass Rule 2 (Executive Condition) of the Role Mapping Policy and was mapped to the Default Role, Guest."Saying this, it immediately presents the exact point of failure and the solution.

CPV + FastMCP Integration Prototype in Code

The biggest advantage of the CPV project is that the business logic is in the Flask routing file (app.pyNot strongly bonded to ), cp_impact_analysis.py, cp_endpoint_sql.py, cp_object_graph.py The advantage is that it is neatly separated into independent Python modules.

Therefore, without needing to modify the existing CPV code, in the same directory cpv_mcp_server.py You can immediately implement the three AI Use Cases discussed earlier by adding just one file.

# 파일명: cpv_mcp_server.py
# 실행 방법: uv run mcp run cpv_mcp_server.py

from typing import Dict, Any, List
from mcp.server.fastmcp import FastMCP

# CPV 기존 코어 모듈 임포트
import cp_environments
import cp_impact_analysis
import cp_object_graph
import cp_endpoint_sql
import cp_insight_sql

# FastMCP 서버 인스턴스 초기화
mcp = FastMCP("ClearPass-ZeroTrust-Advisor")

def _get_env_context(env_name: str = "Prod_Cluster"):
    """CPV의 멀티 환경(v1.7.0) 컨텍스트에서 활성화된 캐시 및 DB 세션을 가져옵니다."""
    env = cp_environments.get_environment_by_name(env_name)
    if not env or not env.is_loaded:
        raise ValueError(f"[{env_name}] 환경이 로드되지 않았거나 존재하지 않습니다.")
    return env


# =====================================================================
# Use Case 1: 자연어 기반 정책 변경 시뮬레이터 (What-If 분석기)
# =====================================================================
@mcp.tool()
def analyze_policy_blast_radius(
    object_type: str, 
    object_name: str, 
    env_name: str = "Prod_Cluster"
) -> Dict[str, Any]:
    """
    특정 ClearPass 객체(Role, Enforcement Profile, Policy 등)를 수정하거나 삭제하기 전,
    해당 객체를 참조하는 모든 상위 정책과 최종 영향받는 Service 목록(폭발 반경)을 역추적합니다.
    
    :param object_type: 'profile', 'enforcement_policy', 'role_mapping', 'role' 중 택 1
    :param object_name: 분석할 객체의 정확한 이름 (예: 'Contractor-Isolate-VLAN-Profile')
    :param env_name: 대상 ClearPass 클러스터 환경 이름 (기본값: Prod_Cluster)
    """
    env = _get_env_context(env_name)
    
    # CPV의 역방향 참조 추적 엔진 호출
    impact_report = cp_impact_analysis.build_impact_report(
        cache=env.cache,
        object_type=object_type,
        target_name=object_name
    )
    
    return {
        "environment": env_name,
        "target_object": f"{object_type}:{object_name}",
        "affected_services_count": len(impact_report.get("affected_services", [])),
        "affected_services": impact_report.get("affected_services", []),
        "referencing_policies": impact_report.get("referencing_policies", []),
        "condition_rules_context": impact_report.get("matched_conditions", []),
        "is_orphan": len(impact_report.get("affected_services", [])) == 0
    }


# =====================================================================
# Use Case 2: GraphRAG 기반 보안 감사 및 Shadow/Dead Policy 탐지
# =====================================================================
@mcp.tool()
def audit_service_graph_and_hits(env_name: str = "Prod_Cluster") -> List[Dict[str, Any]]:
    """
    전체 ClearPass 서비스의 평가 순서(Order), 조건문, 매핑된 Role/Profile 그래프 구조와
    현재 시간대 실제 인증 Hit Count를 결합하여 반환합니다. 
    과도한 권한 부여 경로(Shadow Policy)나 매칭되지 않는 데드 정책(Dead Service) 감사에 활용됩니다.
    """
    env = _get_env_context(env_name)
    
    # 1. CPV 인메모리 객체 그래프에서 전체 서비스 토폴로지 추출
    full_graph = cp_object_graph.export_serializable_graph(env.cache)
    
    # 2. ClearPass Insight PostgreSQL에서 실시간 서비스 Hit Count 조회
    hit_counts = cp_insight_sql.fetch_current_hour_service_hits(env.db_config)
    
    audit_payload = []
    for service in full_graph.get("services", []):
        svc_name = service["name"]
        audit_payload.append({
            "eval_order": service["order"],
            "service_name": svc_name,
            "service_type": service["type"],
            "current_hour_hits": hit_counts.get(svc_name, 0),
            "service_match_rules": service["rules"],
            "role_mapping_flow": service["role_mapping_summary"],
            "enforcement_outcomes": service["enforcement_profiles"]
        })
        
    return audit_payload


# =====================================================================
# Use Case 3: 단말 프로파일링 속성 vs 정책 조건 비교 (자율 트러블슈팅)
# =====================================================================
@mcp.tool()
def diagnose_endpoint_policy_mismatch(
    mac_address: str, 
    expected_service_name: str, 
    env_name: str = "Prod_Cluster"
) -> Dict[str, Any]:
    """
    특정 단말(MAC 주소)이 의도한 권한(Role/VLAN)을 받지 못할 때,
    PostgreSQL(appexternal)의 실시간 단말 프로파일링 속성과 대상 서비스의 Role Mapping 조건을
    나란히 추출하여 LLM이 정확한 불일치(Mismatch) 원인을 찾도록 돕습니다.
    """
    env = _get_env_context(env_name)
    
    # 1. PostgreSQL에서 단말의 현재 Endpoint Repository 속성 직접 쿼리
    endpoint_attrs = cp_endpoint_sql.get_endpoint_details_by_mac(
        db_config=env.db_config, 
        mac_address=mac_address
    )
    
    # 2. 캐시된 정책 트리에서 대상 서비스의 Role Mapping 및 Enforcement 조건문 추출
    target_service = env.cache.get_service_by_name(expected_service_name)
    if not target_service:
        return {"error": f"서비스 '{expected_service_name}'를 찾을 수 없습니다."}
        
    return {
        "mac_address": mac_address,
        "actual_endpoint_attributes": endpoint_attrs, # OS, Category, Custom 태그 등
        "expected_service_conditions": target_service.get("service_conditions"),
        "role_mapping_rules": target_service.get("role_mapping_rules"),
        "default_role": target_service.get("default_role"),
        "enforcement_rules": target_service.get("enforcement_rules")
    }

if __name__ == "__main__":
    mcp.run()

# Filename: cpv_mcp_server.py
# How to run: uv run mcp run cpv_mcp_server.py

from typing import Dict, Any, List
from mcp.server.fastmcp import FastMCP

# CPV Existing Core Module Import
import cp_environments
import cp_impact_analysis
import cp_object_graph
import cp_endpoint_sql
import cp_insight_sql

# Initialize FastMCP server instance
mcp = FastMCP("""ClearPass-ZeroTrust-Advisor""")

def _get_env_context(env_name: str = """Prod_Cluster"""):
    """Retrieves active cache and DB sessions in the CPV multi-environment (v1.7.0) context."""
    env = cp_environments.get_environment_by_name(env_name)
    if not env or not env.is_loaded:
        raise ValueError(f"[{env_name}The environment is not loaded or does not exist.")
    return env


# =====================================================================
# Use Case 1: Natural Language-Based Policy Change Simulator (What-If Analyzer)
# =====================================================================
@mcp.tool()
def analyze_policy_blast_radius(
    object_type: str, 
    object_name: str, 
    env_name: str = """Prod_Cluster"""
) -> Dict[str, Any]:
    """""
    Before modifying or deleting specific ClearPass objects (Role, Enforcement Profile, Policy, etc.),
    Trace back all parent policies referencing the object and the final list of affected services (explosion radius).
    
    :param object_type: Choose 1 from 'profile', 'enforcement_policy', 'role_mapping', 'role'
    :param object_name: The exact name of the object to analyze (e.g., 'Contractor-Isolate-VLAN-Profile')
    :param env_name: Target ClearPass cluster environment name (default: Prod_Cluster)
    """""
    env = _get_env_context(env_name)
    
    # Call CPV's reverse reference tracing engine
    impact_report = cp_impact_analysis.build_impact_report(
        cache=env.cache,
        object_type=object_type,
        target_name=object_name
    )
    
    return {
        """environment""": env_name,
        """target_object""": f"""{object_type}:{object_name}""",
        """affected_services_count""": len(impact_report.get("""affected_services""", [])),
        """affected_services""": impact_report.get("""affected_services""", []),
        """referencing_policies""": impact_report.get("""referencing_policies""", []),
        """condition_rules_context""": impact_report.get("""matched_conditions""", []),
        """is_orphan""": len(impact_report.get("""affected_services""", [])) == 0
    }


# =====================================================================
# Use Case 2: GraphRAG-based Security Auditing and Shadow/Dead Policy Detection
# =====================================================================
@mcp.tool()
def audit_service_graph_and_hits(env_name: str = """Prod_Cluster""") -> List[Dict[str, Any]]:
    """""
    The evaluation order, conditional statements, and mapped Role/Profile graph structure of the entire ClearPass service and
    Combines and returns the actual authentication Hit Count for the current time zone. 
    It is used for auditing excessive authorization paths (Shadow Policy) or mismatched dead policies (Dead Service).
    """""
    env = _get_env_context(env_name)
    
    # 1. Extracting the Full Service Topology from the CPV In-Memory Object Graph
    full_graph = cp_object_graph.export_serializable_graph(env.cache)
    
    # 2. Querying Real-time Service Hit Counts in ClearPass Insight PostgreSQL
    hit_counts = cp_insight_sql.fetch_current_hour_service_hits(env.db_config)
    
    audit_payload = []
    for service in full_graph.get("""services""", []):
        svc_name = service["""name"""]
        audit_payload.append({
            """eval_order""": service["""order"""],
            """service_name""": svc_name,
            """service_type""": service["""type"""],
            """current_hour_hits""": hit_counts.get(svc_name, 0),
            """service_match_rules""": service["""rules"""],
            """role_mapping_flow""": service["""role_mapping_summary"""],
            """enforcement_outcomes""": service["""enforcement_profiles"""]
        })
        
    return audit_payload


# =====================================================================
# Use Case 3: Comparison of Terminal Profiling Attributes vs. Policy Conditions (Autonomous Troubleshooting)
# =====================================================================
@mcp.tool()
def diagnose_endpoint_policy_mismatch(
    mac_address: str, 
    expected_service_name: str, 
    env_name: str = """Prod_Cluster"""
) -> Dict[str, Any]:
    """""
    When a specific terminal (MAC address) does not receive the intended authority (Role/VLAN),
    Real-time terminal profiling attributes of PostgreSQL (appexternal) and Role Mapping conditions of the target service
    It extracts side-by-side to help LLM find the exact cause of the mismatch.
    """""
    env = _get_env_context(env_name)
    
    # 1. Directly query the current Endpoint Repository properties of the terminal in PostgreSQL
    endpoint_attrs = cp_endpoint_sql.get_endpoint_details_by_mac(
        db_config=env.db_config, 
        mac_address=mac_address
    )
    
    # 2. Extract Role Mapping and Enforcement Conditions for Target Services from Cached Policy Tree
    target_service = env.cache.get_service_by_name(expected_service_name)
    if not target_service:
        return {"""error""": f"service '{expected_service_name}'Cannot find."}
        
    return {
        """mac_address""": mac_address,
        """actual_endpoint_attributes""": endpoint_attrs, # OS, Category, Custom Tags, etc.
        """expected_service_conditions""": target_service.get("""service_conditions"""),
        """role_mapping_rules""": target_service.get("""role_mapping_rules"""),
        """default_role""": target_service.get("""default_role"""),
        """enforcement_rules""": target_service.get("""enforcement_rules""")
    }

if __name__ == """__main__""":
    mcp.run()

In conclusion: Visibility is the beginning of AI automation

ClearPass's multi-level structure, consisting of Roles, Role Mapping, Enforcement Profiles, and Policies, is a powerful weapon for designing airtight enterprise security, but it was also a double-edged sword that tested the cognitive limits of human administrators.

ClearPass Policy Visualiser (CPV) is an excellent open source that puts these complex puzzle pieces together into a single map.
Furthermore, from an architectural perspective, fragmented security policies Core middleware that converts into a ‘Graph Context’ that AI agents can understand and reason about.Its value shines even brighter.

Existing CPV Flask route(app.pyJust add a few lines of API endpoint code to ) that returns graphs and impact analysis results as pure JSON, and this Python FastMCPJust by wrapping ourselves in it, our own powerful AI NAC AssistantYou can prototype it. If you are considering intelligent Zero Trust operations to escape the fatigue of switching between complex policy tabs, why not upload your CPV to the testbed right now?