WAFY's F5 ASM experience includes the Advanced WAF (ASM) policies managed for two major airlines, protecting highly critical live systems including booking and airline operational applications. Change control was extremely strict, with significant testing, documentation, meetings and approvals required before anything could be altered in production. As a result, the work was less about making frequent configuration changes and more about managing the policies safely within those restrictions. The policies were kept reasonably loose where necessary, because the operational cost and risk of introducing a change was high. Every proposed change was documented, presented, tested and introduced individually, in accordance with the airline's change-control processes. A particularly important part of the work was the close relationship with the application-development teams, so that changes to the applications and the corresponding changes to ASM could be understood, agreed and implemented safely.