Patent ID: 8667556

Claim:
A method comprising: at an application service appliance device, detecting a presence of one or more network users; logging activities of the network users on at least one of a per user basis and a per resource basis, wherein the activities comprise activities of the network users accessing resources of an application server of a datacenter configured to communicate with the application service appliance device such that the application service appliance device operates as an application service gateway to the datacenter; generating a log file from the logging for each of the network users; creating a first policy from the log file for enforcement of real time traffic and a second policy from the log file for simulation of real time traffic to evaluate the first policy of enforcement of the real time traffic without impacting the real time traffic, wherein the first policy and the second policy are based on the real time traffic associated with the network users and attributes extracted from the activities of the network users, the attributes including at least one of a network user attribute, an environment attribute, and a resource attribute; simulating the real time traffic to evaluate the first policy of enforcement by applying the second policy to the simulated real time traffic; generating a simulation result from the simulating; when the simulation result satisfies a predetermined condition, committing the first policy to be enforced in the application services appliance device to determine whether a particular one of the network users is eligible to access a particular resource of the datacenter; and modifying the first policy when the simulation result does not satisfy the predetermined condition.