This figure shows that when a rule to apply a policy only to devices tagged with an access role and to interfaces tagged with an ethernet role is applied, then the policy is only applied at policy targets tagged with the appropriate roles in the network.