I'm assuming you are wanting to require EMC to obtain permission before they can remote access to the VMAX, is that correct?

Yes would be useful

If I went to our security engineer and told him EMC can dial into our SAN whenever he wouldnt be best pleased.

I have left it open for now but this will need to be changed.

Assuming the Policy Manager is installed and functioning correctly and the correct SMTP server was used when the Policy Manager was installed, there are two tasks that have to be performed to implement "Ask for Approval" policies.  This is normally something EMC would do when the Policy Manager is installed. 

(1) Launch Policy Manager and click on the Configuration tab.  Click the Global link under the name column.  Under Notification Information, enter the email that should receive the notification in the "To Other(s)" field. In the Subject field, enter "Authorization required for requested EMC support action to device <$A_SN>".  Click Submit.

(2) Create filters for the VMAX for all the applications that run on the VMAX for which you want to require EMC to obtain permission.  See table 17 on page 413 of the Operation's Guide, release 2.14 for the Remote Application names.  This step is a little tedious but look at the document titled "Create Ask For Approval Policies in ESRS 2 Policy Manager" in the documents section of this forum.

After you do this, open a service request and ask EMC to test remote access to the VMAX.  A remote access request should trigger the email and allow you to allow or deny the request.