F5 newbie - trying to work things out - help :)

So I have found a working answer

based upon this

https://devcentral.f5.com/s/question/0D51T00006i7Xc3/only-enable-access-policy-when-server-response-is-401

basically attach access profile and per request profile to first VS

then use irule to turn access on and off where needed

so i have a switch that pulls out the protected url

and a default that turns it off, except if hrmsession is not empty !

the one issue which i worked around is the sso forms based login uri including /

not sure I fully understand how the sso is supposed to work .. another thread

this works really well its all in 1 vs so ...