Policy Guide › What Is in a User Policy? › Actions › Control Action Precedence

Control Action Precedence

An event can fire multiple control triggers and each trigger can potentially fire a separate control action. The order in which multiple control actions are applied out is determined by the control action number. That is, the control action with the lowest number takes precedence—see example below. This has important implications for the Intervention setting. For example, if a Warning control action takes precedence over a Blocking control action, the event generates a warning but is not necessarily blocked.

Note: This also has important implications for quarantine events.

Example

If an email causes three control triggers to activate (Attachment, Recipient and Search Text), then these triggers respectively invoke control action 5, control action 2 and control 3, with control action 2 being applied first. The only action invoked against the event will be Control Action 2, because after an event is blocked, no other actions can be invoked.

• A Recipient trigger invokes Control Action 2: Blocking. This control action is applied 1st.
• A Search Text trigger invokes Control Action 3: Quarantine. This control action is applied 2nd.
• An Attachment trigger invokes Control Action 5: Warning. This control action is applied 3rd.

Intervention options

This section summarizes how intervention options affect any subsequent control actions:

• If a Blocking occurs, no other actions are invoked subsequently.
• If a Warning occurs and the user clicks Cancel, no other actions are invoked subsequently.
• If a Warning occurs and the user clicks Continue, the next control action is invoked.
• If a Quarantine control action occurs, no other actions are invoked subsequently.
• If a Silent control action occurs, the next control action is invoked.

Quarantine control actions

Important! Use the highest number control action as your Quarantine control action in order to give it the lowest priority.

The precedence of control actions has an important effect on quarantined e-mails. If an email causes a control trigger to fire, which then invokes a quarantine control action, the email is exempt from further control actions. That is, a quarantined email cannot also be blocked or generate a warning.

We therefore recommend that you use highest control action as the Quarantine control action. For example, if there are 10 control actions, configure Control Action 10 as the Quarantine control action.

This means that if an email causes mulitple control triggers to fire, invoking multiple control actions, the quarantine control action is applied to the email last. This allows other control actions, such as warnings, to be invoked first. For example if a user sends an email containing bad language, you may want to warn the user. If he or she ignores the warning, you can then quarantine the message.