Core Concepts

The vocabulary of BlazeRules: rules, conditions, operators, actions, decisions, scores, risk bands, winning rules, and how a batch is evaluated.

This page defines the terms used throughout the BlazeRules documentation and explains the two outputs every evaluation produces: a categorical decision and a numeric score. Read this once and the rest of the docs read faster.

Glossary

TermMeaning
Rule setA named, versioned collection of rules under the top-level ruleset: key.
RuleA single unit with an id, an action, optional severity and weight, and a conditions: tree.
Condition treeThe boolean expression of a rule, built from and / or / not wrapping individual conditions.
OperatorThe test applied to a field, given by op: (one of 50, e.g. gt, in, regex, ip_in_subnet).
ActionWhat a matching rule asks for: approve, flag, review, block, or score.
SeverityA qualitative level on a rule: LOW, MEDIUM, HIGH, or CRITICAL.
WeightA numeric contribution a matching rule adds toward a record's score.
ScoreA numeric value accumulated from the weights of the rules a record matched.
Risk bandA categorical bucket derived from the score, returned in result.risk_bands.
DecisionThe single categorical verdict for a record, chosen from matched actions by precedence.
Winning ruleThe rule that determined a record's decision, returned in result.winning_rule_ids.
Decision precedenceThe ordered ladder that resolves which action wins when several fire.
Shadow ruleA rule evaluated for observation without affecting the live decision.
BatchThe unit of evaluation — many records evaluated together in one call.
Schema inferenceDeriving column types from the first evaluated batch when no schema is supplied.
Derived columnA column computed once per batch from a window, model_score, or vector_distance.
WindowA stateful aggregate (count/sum/avg/ratio/min/max) over an entity's prior batches.
LookupA named CSV set (string/int/CIDR) referenced by in_lookup / not_in_lookup operators.

Two outputs: decision and score

Every record produces both a decision and a score. They answer different questions and are computed differently.

Decision — the verdict

A single categorical outcome (e.g. BLOCK, REVIEW, APPROVE). When more than one rule matches a record, the decision precedence ladder picks the winner, and that rule becomes the record's winning rule (result.winning_rule_ids). Use result.indices_for_decision(...) and grouped_decision_indices() to route a batch by decision.

Score — the magnitude

A numeric value accumulated from the weight of every rule the record matched. The score is then mapped into a risk band (result.risk_bands). Scoring is additive across matched rules, independent of which single rule won the decision.

Decision precedence

When several rules fire on one record, their actions are resolved by a configurable ladder set at the top level of the rule file:

decisions:
  default: approve
  precedence: [approve, flag, review, block]

default is the decision for a record that matched no rule. precedence orders the actions from lowest to highest priority, so the most severe matched action wins. The README documents the default ladder as block > review > flag > score > approve; the canonical sample file pins its own order as shown above. Tune it to your domain via the decisions: block.

Risk bands are HIGH, MEDIUM, and LOW: BLOCK or score >= 80 is high, REVIEW or score >= 40 is medium, FLAG or a positive score is low, and unmatched records are low. A shadow: true rule still appears in match counts, but it does not add score, change the decision, or become the winning rule.

Where to go next