redirection semantics
If you ask the switch to allow a client through, do existing flows break?
We assume that all switches keep per-flow state, and can redirect new connections without breaking old ones.
Multiple services -- Redirection occurs per service.