15 Rules, and paying for them

15.1 Why a network needs rules it can change while you are using it

Equipment can be configured. A configuration file is written once, applies to everything passing through that node, and changes when somebody deploys a new one.

That is not enough here. What one subscriber may do depends on who they are, what they bought, which slice they asked for, where they are standing, what an application asked the network for, and how much they have already spent this month. All of that can change while a session is open.

So the core keeps those decisions in one function, decides them per subscriber and per session at the moment they are needed, and pushes the answer to whoever has to act on it. That is policy.

You would expect §5.14, the clause named Policy Control, to explain all of this. It is one sentence.

That is the entire clause. Charging, §5.12, is longer but no wider: it names who talks to the Charging Function and under which document, and adds one mechanism of its own, the reporting of data volumes carried on a second radio technology.

Both subjects have their own documents. What 23.501 keeps is the architecture around them: which function decides, where it sits, how it is found, and what it hands to whom — material scattered through other clauses, which is what this chapter gathers.

15.2 The PCF, and the three conversations it holds

The Policy Control Function is described in four bullets. It governs network behaviour with one policy framework, and it gives policy rules to control-plane functions to enforce.

The other two say where it gets what it needs: it reads subscription data from a Unified Data Repository, the UDR (the store of subscriber records), in its own network, and it supports PDU Set handling — one PDU Set is the packets that carry a single frame of video.

The rest is clause 6.2.1 of TS 23.503 [45] §6.2.4.

Its neighbours are named as reference points. N15 goes to the AMF (the function that keeps track of where a device is and whether it is reachable), N7 to the SMF (the function that sets up and steers a data session), and N5 to an application function.

N30 goes to the NEF (the doorway through which servers outside the operator reach the core), N36 to the UDR, N23 to the NWDAF (the function that gathers measurements and reports what it makes of them), N28 to the CHF, N24 between a visited and a home PCF, and N43 between PCFs §4.2.7.

Three long-lived relationships carry the actual work:

Association	Between	Carries
AM Policy Association	AMF and PCF	access and mobility policy
UE Policy Association	AMF and PCF	policies for the phone itself
SM Policy Association	SMF and PCF	session policy, as PCC rules

The matching services are Npcf_AMPolicyControl, Npcf_UEPolicyControl and Npcf_SMPolicyControl. The same table also lists Npcf_PolicyAuthorization, the service an application function uses to ask for something on a session §7.2.4.

One subscriber may be served by two PCFs at once: the document calls them the PCF for the UE and the PCF for the PDU Session, and they can be different instances §6.3.7.1.

15.3 Policy you can see elsewhere in the document

Nothing in 23.501 lists the policy decisions, so here are five that clauses elsewhere name outright:

• The PCF can tell the AMF, during registration, to replace a data network name the phone asked for with a different one §5.6.1.

• The session and service continuity mode a phone requests comes from a policy rule the operator sent it §5.6.9.3.

• Which slice an application uses is a policy rule in the phone §5.15.5.3.

• How a multi-access session splits traffic across mobile and Wi-Fi is a PCC rule §5.32.3, which is Using two accesses at once.

• Energy saving reaches both the access-and-mobility decision and the session decision, and the reason is written into the PCC rule so charging can see it §5.51.6.

15.4 From a policy rule to packet handling

Over N7 the PCF gives the SMF PCC rules — policy and charging control rules, the abbreviation coming from the title of TS 23.503 [45]. Two kinds exist. A dynamic rule is sent whole. A predefined rule is already configured in the SMF and the PCF only switches it on or off by name §5.8.2.8.1.

The SMF is the translator. It binds PCC rules to QoS Flows, assigns the flow identifier, and derives the QoS profile for the radio network and the QoS rules for the phone.

It also derives the packet detection and enforcement rules for the UPF (the box in the data path that forwards, counts and drops the packets themselves) §5.7.1.5 — see What the network promises and Where the packets actually go.

Where those pieces sit is not free. Traffic detection filters may be configured in the SMF and sent to the UPF, or configured in the UPF and named from the rule by an application identifier §5.8.2.8.2.

Traffic steering policies can only be configured in the UPF, and the SMF is configured with their identifiers. Traffic-handling policies sit in the UPF as well, as ready-made rules the SMF switches on by identifier §5.8.2.8.1.

Redirection is the same kind of split: the destination arrives inside the rule or is preconfigured at either end §5.8.2.8.3.

15.5 How a policy reaches the phone

Policies for the phone do not travel over any interface of their own. "UE Policy" is one of the payload types that the NAS mobility-management protocol carries over N1, alongside session management, SMS and location services. The AMF forwards it and does not read it §8.2.2.1.

The best-known content is URSP, the UE Route Selection Policy. It answers the question an operating system faces when an application wants to send something: which existing session should this go on, and if none fits, what should be requested?

Each rule has a traffic descriptor and a set of components. From 23.501's own uses you can see three of them at work:

• The Network Slice Selection Policy associates an application with one or more home-network S-NSSAIs — an S-NSSAI is the name of one slice, the operator's separately run share of the network. The phone indicates that S-NSSAI when it asks for a session, and indicates none if it can determine none §5.15.5.3.

• The PDU session type in the matching rule sets the type the phone requests, and a rule with a "match all" descriptor is the fallback §5.8.2.2.1.

• The session and service continuity mode selection policy tells the phone which continuity mode to ask for §5.6.9.3.

Access-network selection travels the same way. For untrusted Wi-Fi the home network's PCF sends N3IWF selection information — the N3IWF (the gateway that lets a phone on somebody else's Wi-Fi into the core) is chosen with the subscribed slices taken into account §6.3.6.1.

For trusted access the phone ranks the Wi-Fi networks it can see using WLANSP rules, if it has been given any §6.3.12.2. The rule contents themselves are clause 6.6.2 and clause 6.6.1 of TS 23.503 [45], and the phone-side handling is TS 24.526 [110].

A phone can even be given URSP rules while it is camped on 4G. The rules ride in a container inside the protocol configuration options of a PDN connection, and the PCF for the PDU Session forwards them.

When the phone moved from 5G to 4G, that PCF finds the PCF for the UE by asking the binding support function, the BSF §5.17.8. That is Living next to 4G.

15.6 Which PCF, and why the BSF exists

There may be many PCFs in one network, and policy may be switched on for only some data networks §6.3.7.0. Selection is done by the AMF for a subscriber and by the SMF for a session, from the NRF (the directory the core looks its own functions up in) or from local configuration.

What they select on is the subscriber identity, the slice, a PCF Set or Group ID, and the capabilities the PCF needs to have. The AMF may pass its choice to the SMF, and a Same PCF Selection Indication makes the reuse binding §6.3.7.1.

That freedom creates the hard problem of this clause.

An application function knows an IP address and a service. It does not know the subscriber, the session, or which PCF holds that session's policy. Something has to keep the index.

That is the Binding Support Function (the index that records which PCF is holding which session). Its one service, Nbsf_Management, lets a PCF register and deregister itself and be discovered; the PCF for the UE and the PCF for the PDU Session register separately and are found separately §7.2.15.

A BSF's profile in the NRF is what you would expect an index to be advertised by: ranges of UE IPv4 addresses or IPv6 prefixes, ranges of SUPIs (the subscriber's permanent identity inside the network) or GPSIs (the number the outside world knows that subscriber by, such as a phone number).

It may also carry a BSF Group ID §6.2.6.2, which names the instances holding a given set of subscriber identities §3.1.

It is useful beyond policy. A function that subscribes to data collection from a UPF but knows only the UE's IP address may need to ask the BSF for the SUPI behind the triple of address, DNN and slice §6.3.3.1.

Where a whole IP range sits behind one phone, the PCF may report those routes to the BSF as well, so that binding still works §5.6.14.

The lookups themselves — turning an application function's request into the right PCF — are clause 6.1.1.2 and clause 6.1.1.2a of TS 23.503 [45] §6.3.7.3 §6.3.7.4.

A request aimed at a group of subscribers, or at any subscriber at all, takes a different path: the NEF stores it in the UDR and every interested PCF subscribes to be notified §6.3.7.2.

15.7 Charging: who counts, and who decides to stop

Most of §5.12 is a list of who talks to the Charging Function and under which document §5.12.1. The CHF sits at N40 from the SMF, N41 and N42 from the AMF, and N28 from the PCF §4.2.7.

It offers converged charging, offline-only charging, and spending limit control — the last one feeding policy counters back to the PCF, so a policy decision can depend on how much has already been spent §7.2.17.

The document is precise about where counting happens.

The UPF counts and knows nothing else. Meaning stays in the SMF: it issues usage reporting rules, one per charging key from the active PCC rules and one per monitoring key for usage monitoring, each tied to the packet detection rules whose traffic it covers.

Triggers may be a volume, a time or an event, and the thresholds come from what the PCF or the CHF allowed §5.8.2.6.2. The UPF reports periodically, on a threshold, or on demand, and the SMF adds the session and subscriber facts before it reports onward §5.8.2.6.3.

The moment traffic is stopped or allowed is one attribute of a PCC rule: service data flow handling while requesting credit.

When it says "non-blocking", the SMF gives the UPF a default threshold and the traffic runs while the quota request to the CHF is outstanding §5.8.2.6.2. What happens for any other value is settled in TS 23.503 [45], not here.

Two smaller pieces round it out. When a session's user plane is down and downlink data piles up past a threshold, pause of charging keeps the bytes the core dropped out of the records §5.8.2.20.

The second is the one mechanism §5.12 describes in its own right. When a phone is using a second radio technology in dual connectivity, the radio network counts that traffic itself.

It is switched on by radio-network management rather than by the core, reported at handover and at release, and optionally on a timer so that partial records can be produced §5.12.2 §5.12.3.

The subscription contributes one field of its own: Charging Characteristics, per data network name and slice, retrieved by the SMF from the UDM (the keeper of what a subscriber is allowed to have) §5.6.1.

Which CHF is used follows a two-step rule. An address stored in the UDR wins; without one, operator policy picks between the address the NRF offers and the one configured locally. The PCF may then hand its chosen CHF to the SMF and the AMF so all three agree §6.3.11.

15.8 Where this document stops

Question	Document
What a policy rule contains; how the PCF decides	TS 23.503 [45]
What is in a URSP rule; how the phone evaluates one	clause 6.6.2 of TS 23.503 [45], then TS 24.526 [110]
Binding an application function's request to a PCF	clauses 6.1.1.2 and 6.1.1.2a of TS 23.503 [45]
Charging architecture and principles	TS 32.240 [41]
The CHF and its services	TS 32.290 [67]
SMF charging, and Charging Characteristics	TS 32.255 [68]
AMF charging	TS 32.256 [114]
SMS charging at the SMSF	TS 32.274 [118]
NEF charging	TS 32.254 [123]
Usage report parameters on N4	TS 29.244 [65]
The secondary radio usage report itself	TS 38.413 [34]

Inside 23.501 the neighbours are What each network function does for these three as functions, How one function finds another for how any of them is discovered, and What the network promises for what a PCC rule turns into.

Then Where the packets actually go for where it is enforced, and Being served by somebody else's network for the split between a visited and a home PCF across N24.