> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quintai.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Write and publish a rule

> Build a rule, check what it would have matched, publish it to your machines, and read the matches it records.

Rules live under **Policies › Rules**. Editing and publishing rules needs the Admin or Owner role.

Before you start, read [How policies work](https://docs.quintai.dev/policies/how-policies-work.md): rules start in shadow mode and only record until the workspace is armed.

**1. Open the rule builder**

On **Policies › Rules**, press **Edit Rules**. Choose where to start: **What's active now** copies the rules your machines currently hold; **Blank** starts from nothing.

Sentinel can open the same builder pre-filled from a proposal. An incident's **Response** card has **Draft a shadow rule**, which opens **Policies › Rules** with nothing pre-filled. The builder's own **Publish** is the only thing that saves, whichever way you arrived.

**2. Add a rule**

Press **Add a rule**. A rule is one disposition over conditions:

* The disposition is what the rule wants when it matches: **record**, **ask** or **refuse**.
* The conditions say what the rule is about, across up to six kinds of condition. Every kind you fill in must match. Within one kind, any one value is enough.

Keep each rule about one thing. Two narrow rules read better in **Matches** than one broad rule.

**3. Check rules**

Press **Check rules**. The builder validates the set and reports problems before anything is published.

**4. Publish**

Press **Publish…**. A review opens showing what these rules would have matched recently. Nothing is saved until you confirm there. On confirmation the set gets a new **serial** and your machines pick it up.

> [!WARNING]
>
> Publishing an empty set removes every rule your machines currently hold. The builder says so: "Add at least one rule — publishing an empty set removes every rule your machines currently hold."

**5. Read the matches**

**Policies › Matches** lists every time a rule noticed an action, with facets by **Decision** and **By rule**. The header chart shows **Rule matches over time** by day. In the page's words: "A match means a rule noticed the action — it does not mean the action was wrong, or that it was interrupted. One action can match several rules."

Every label says what the rule *would have* done ("would have refused", "would have asked", "recorded"), never what happened, because in shadow mode nothing is interrupted.

## Why didn't my rule match?

| Check | Where |
| - | - |
| Did the action happen in the window you are looking at? | **Matches**, time range |
| Did every condition kind you filled in match? All kinds are required together; only values within one kind are alternatives | The rule, in **Edit Rules** |
| Is the serial your machines hold the one you published? | **Policies** header, **Serving now** and **Fleet** |
| Did the action reach Quint at all? | **Live Activity**; if empty, [Verify and troubleshoot](https://docs.quintai.dev/install/verify-and-troubleshoot.md) |
| What would the rule have done against real traffic? | [Shadow enforcement](https://docs.quintai.dev/policies/shadow-enforcement.md) |

## Next

* [Shadow enforcement](https://docs.quintai.dev/policies/shadow-enforcement.md): read what your rules would have done, and what arming means.
* [Alerts](https://docs.quintai.dev/policies/notifications.md): where a refused action is sent, and a scheduled summary of what your rules matched to Slack, Teams or a webhook.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.