The key requirement is:
Users must be able to access all client's Service Hub production and non-production URLs only when they are:
- on the client's network, OR
- using an approved client's device such as:
- client's laptop
- client's virtual desktop
- authenticated mobile device through the Now application.
If someone comes from outside the client's network or using an unmanaged/unapproved/unauthenticated device, they must be blocked before they reach the Service Hub login page.
The acceptance criteria in your screenshot are:
AC Requirement
| AC1 – Access Control | Client's network or approved device → allow access and normal authentication |
| AC2 – Block Unauthorized External Access | External network + unapproved device → block before login |
| AC3 – Consistent Enforcement | Same restriction across every Client's Service Hub prod/non-prod instance |
