ClearPass installations often contain dozens of services. To keep the policy logic manageable, administrators use Service Groups or Filtering . By categorizing services based on access type (e.g., all "802.1X Wireless" services together), the specialist can focus on the specific "stack" of rules that apply to a request. This organization makes it easier to verify that more specific rules are prioritized correctly over generic ones.

To differentiate security levels based on device type (e.g., giving a VoIP phone different access than a laptop), ClearPass must use Profiling . The service first identifies the device type using various collectors and then evaluates this information in the Enforcement Policy . This allows the administrator to select specific Enforcement Profiles (VLANs/ACLs) that are dynamically assigned based on the high-fidelity profile data gathered at connection time.