# Firewall Orchestration

NexaFabric must never overwrite productive firewall state without operator intent.

Required lifecycle:

1. Compile policy.
2. Generate preview.
3. Detect warnings and conflicts.
4. Persist audit record.
5. Require approval for apply.
6. Acquire a cluster/node lock.
7. Apply provider-specific rules.
8. Detect drift after apply.
9. Support rollback using previous compiled versions.