The Life of a Rule

Replay a corpus of the estate's real stored objects through both the old and the new engine-and-rules pair, then diff the decisions. Deny-to-allow flips are enforcement regressions; allow-to-deny flips are the blast radius you are about to inflict.

Two rules own the same field with different intents: validation judges the value the defaulting rule just wrote. Give the field one authority - make the default compliant - and test the two rules together rather than separately.

Treat the rule as a published interface with consumers. Decide whether the control is going or only this encoding, enumerate who imports it, announce a dated removal sized to the slowest consumer, then actually delete it - never leave an always-allow stub.

Usually both survive, because they are not the same control. The gate rule is preventive and stops a non-compliant change before it lands; the nightly benchmark is detective and reports live systems afterwards. Neither covers the other's blind spot.

Enumerate the rule's branches by reading the rule, not the corpus, then hand-write a fixture for each branch reality has not yet produced. Captured plans only contain what teams have already done, so whole conditions can sit untested behind a green suite.

Each sweep record must carry the digest of the ruleset it loaded, and every published ruleset must still be retrievable by that digest so its rule text can be read back. A digest you can no longer resolve to content proves nothing.

Not as written. A rule is only shippable if every population it denies has a fix someone can perform, and nobody can add lineage metadata to a vendor's image. Narrow it to your own builds, or shelve it.

Stamp a schemaVersion on the input document and have each rule declare which versions it can decide over. On an unknown version the rule refuses to decide and the gate blocks, so drift is loud.

Split authorship, ownership and operation. Move each rule to the domain team closest to the resource, transferred with its fixtures, its reason and its current denial rate, and with real authority to change it. Keep contractual rules central. Give unowned rules an expiry, not indefinite life.

Widening a shared parameter is a scope change, not an exception: it applies to every artifact reading that set, retroactively and silently. Approval belongs with the set's accountable owner plus the rule owner, on a computed delta of flipped decisions.

Versions are library-granular; a bad rule is not. Ship the off switch as configuration every enforcer reads at evaluation time so pinned consumers are covered too, then fix the rule forward in a new version. Never republish changed content under an existing version.

Treat the budget as a finite shared resource with an owner. Require a measured latency cost per proposed rule, admit it to the blocking path only when the prevention is worth the spend, and default the rest to out-of-band checks.

Remove your team's monopoly on explanation: publish the evaluated input, version the rules so the deciding revision can be fetched, and ship one command that replays both and names the rule and field path.

Neither, as a big-bang. Find a rule-library version both engine majors accept, ship and bake that, then move the engine, then adopt new-engine-only constructs. Two small windows beat one large one, and you must name the window where enforcement is weakest.