Timeline of one Cloud Armor rule deploy: rules create returns at t equals zero, the verify probe fires at about ten seconds and gets a 401, but the rule only starts enforcing at the edge around 95 to 100 seconds — the probe landed about 90 seconds inside the propagation window. data-plane propagation rule not yet enforcing at the edge t = 0 — rules create returns control plane accepted the rule t ≈ 95–100 s — rule live at the edge the same request is now denied → 403 the probe fired ~90 s inside the propagation window t ≈ 10 s — verify probe fires absent-secret request → 401 from the backend ✗ read as “fail-open”

Hover or tap a marker, the band, or the probe to see what each moment means.

The verify probe raced the rule it was verifying — and lost every time. It fired ~10 s after create, ~90 s before the edge was enforcing, so it measured a world where the rule didn’t exist yet.