% Generated by roxygen2: do not edit by hand
% Please edit documentation in R/policy.R
\name{add_rule}
\alias{add_rule}
\title{Add a rule to a policy}
\usage{
add_rule(
  policy,
  id,
  pattern = NULL,
  fn = NULL,
  owasp = NULL,
  severity = "medium",
  action = "redact",
  description = ""
)
}
\arguments{
\item{policy}{A \code{shieldr_policy} or built-in policy name such as \code{"comprehensive"}.}

\item{id}{Rule identifier.}

\item{pattern}{Regular expression pattern, or \code{NULL}.}

\item{fn}{Predicate function, or \code{NULL}.}

\item{owasp}{Optional OWASP category.}

\item{severity}{One of \code{"low"}, \code{"medium"}, \code{"high"}, or \code{"critical"}.}

\item{action}{One of \code{"allow"}, \code{"redact"}, or \code{"block"}.}

\item{description}{Rule description.}
}
\value{
The modified \code{shieldr_policy}, invisibly.
}
\description{
\code{add_rule()} appends one validated rule to an existing policy. The function
returns the modified policy invisibly so it can be used in assignment or
pipes.
}
\details{
A rule can be regex-based or function-based, but not both. Regex rules are
best when you need span-level redaction. Function rules are useful when the
condition is easier to express in R, such as "this text contains both a
student reference and a home-address phrase".

Severity determines the numeric contribution to the report score:
\itemize{
\item \code{low}: \code{0.1}
\item \code{medium}: \code{0.3}
\item \code{high}: \code{0.6}
\item \code{critical}: \code{1.0}
}

The rule \code{action} is the rule author's preferred outcome when the rule
fires. The final report action also considers total score and policy
thresholds.
}
\examples{
policy <- build_policy()
policy <- add_rule(policy, "demo.secret", pattern = "SECRET", owasp = "llm02")
}
