What Flow Network Security function is a schema of rules for specifying/enforcing a desired behavior...

In the terminology of Flow Network Security Next-Gen (FNS NG), the components are defined as follows:

Security Policy Model: Defined as "A schema of policies for specifying and enforcing a desired behavior.4 A Policy Model will have one or more policies."5 This model provides the framework (such as Application, Isolation, or Quarantine) within which specific policies are created.

Security Policy: Defined as a "collection of security rules and assets [entities, endpoints, categories, applications, etc.] on which the rules have to be enforced together."6

Therefore, the function that acts as the overarching schema and contains "one or more policies" is the Security Policy Model.7