For example, you might specify that when any computer on the HR subnet attempts to communicate with the HR server, all traffic must be encrypted and signed.
You might specify that when any computer in the organization accesses the employee benefits database, all communication should be signed only.