> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Manage Code Defender policy rules

Once you have [created policy rules,](/applications/create-code-defender-policy-rules) you can manage them from the **Policy Rules** page. Policy rules are organized into different tabs:

* **Client-side rules:** Rules that **allow** or **block** script actions.
* **PCI DSS rules:** Rules that authorize scripts for PCI DSS 4’s requirement 6.4.3.

Each section separates its available rules into three categories:

* **Active:** Rules that are currently published and running for each detected script or action.
* **Draft:** Rules that are not completed or have not been activated yet.
* **Archived:** Rules that were previously published, but are no longer running.

You can learn about each category below.

## Prerequisites

To manage and make changes to policy rules, you must have at least a **Developer** role.

## Active rules

All rules that Code Defender currently enforces are in the **Active** tab. There are two types of active rules: [mitigation rules](#mitigation-rules) and [classification rules.](#classification-rules)

### Mitigation rules

**Mitigation rules** are rules where Code Defender or PCI DSS automatically block or allow script actions if they are present on the deny or allow list respectively. You can click on each rule to view the deny or allow list.

Mitigation rules are prioritized over [classification rules](#classification-rules). For example, if a script action already exists on the deny list, then Code Defender will block that action and will not process any other rules. This means that, if a classification rule exists for that action, Code Defender will never consider it. For more information, see [Active rule priority.](#active-rule-priority)

### Classification rules

**Classification rules** are custom rules you [created.](/applications/create-code-defender-policy-rules) Code Defender processes these rules if the script action doesn't match any conditions in **Mitigation rules.**

You can click a classification rule to view its conditions and perform the following actions:

* **Set rule priority:** Change the rule's priority. See [active rule priority](#active-rule-priority) for more information.
* **Archive rule:** Deactivate the policy rule on your application and move it to the **Archive** tab. When you activate, you must also select a **rule priority.**
* **Open edit mode:** Make revisions to the rule.
* **Duplicate rule:** Make a copy of the rule.

You can also **drag and drop** rules to update Code Defender’s **rule priority.**

### Active rule priority

Code Defender evaluates each script action against active rules by **order of priority** starting with **Mitigation rules** and then **Classification rules** with rule number 1. This means that, when matching script actions to policy rules, Code Defender uses the following logic:

1. Code Defender attempts to match the script action to the conditions in each policy rule **one by one**.
2. When Code Defender finds the **first policy rule** with conditions that match the detected script action, then Code Defender performs the **action** related to that rule.
3. Code Defender **stops** attempting to match the script action with any remaining policy rules.

This means that if you have two or more policy rules with matching conditions, then Code Defender will prioritize completing the action associated with the **earlier** rule, then **stop** considering the remaining rules. So, for example, say your policy rules are ordered like this:

1. Policy rule that **allows** all script actions detected on **all host domains.**
2. Policy rule that **allows** all scripts actions from **all known vendors.**
3. Policy rule that **blocks** specific undesired **script actions** taken by any script belonging to **a specific script vendor.**

If your application receives a script from the specified vendor **Policy Rule 3,** and this script performs the specified undesired actions, those script actions **will not** be blocked even though the rule exists. This is because this vendor is also considered a **known vendor** in **Policy Rule 2.** Since the latter is the earlier rule, it is prioritized, and the vendor will be **allowed.** Code Defender will **never** continue on to the next rule.

## Draft rules

All rules that you’re currently editing or are not yet active are in the **Draft** tab. You can click a rule to view its conditions and perform the following actions:

* **Activate rule:** Start enforcing the policy rule on your application and move it to the **Active** tab. When you activate, you must also select a [rule priority.](#active-rule-priority)
* **Delete rule:** Remove the rule permanently from your account.
* **Open edit mode:** Make revisions to the rule.
* **Duplicate rule:** Make a copy of the rule.

## Archived rules

All rules that were previously active but have since been deactivated are in the **Archive** tab. You can click a rule to view its conditions and perform the following actions:

* **Activate rule:** Start enforcing the policy rule on your application and move it to the **Active** tab. When you activate, you must also select a [rule priority.](#active-rule-priority)
* **Move to drafts:** Move the rule to the **Draft** tab.
* **Open edit mode:** Make revisions to the rule.
* **Duplicate rule:** Make a copy of the rule.