Vendor lineage
AlgoSec - policy from the application's point of view
Asks which application a rule serves, which is the question the rule does not record.
AlgoSec works the same estates as the rest of this cluster and frames the problem differently: rather than starting from the rule, it starts from the application and asks what connectivity that application needs. Its own material describes automating application connectivity alongside security policy.
The framing matters more than it sounds. A firewall rule records addresses, ports and an action; it does not record why it exists or which service breaks if it is removed. That missing field is the reason nobody deletes rules - the risk of removing a rule that turns out to matter is concrete, and the benefit of a shorter list is abstract.
Anything that reattaches rules to the applications behind them is attacking that asymmetry, which is the only thing that makes cleanup possible at all.