A provider PE router carries multiple customer VPNs over a single physical uplink. The provider must enforce a 10 Mbps per-customer aggregate and still apply per-flow policing inside each customer. Which is the appropriate QoS architecture on the uplink interface?

Hierarchical QoS (HQoS) is the correct approach because it allows for both aggregate shaping and per-flow policing. A parent policy can shape the total bandwidth for the uplink to 10 Mbps, ensuring the provider's commitment. Within this parent policy, child service policies can then be applied to individual customer VPNs, enabling per-flow policing as required. This provides granular control within the overall bandwidth constraint. Configuring separate physical sub-interfaces is inefficient and often impractical for multiple VPNs. Applying only child policies without a parent shaper would not enforce the aggregate 10 Mbps limit. Routing policy maps control routing decisions, not bandwidth enforcement.