> ## Documentation Index
> Fetch the complete documentation index at: https://docs.porcia.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Rules

> Automated alerts and actions triggered by events in your SaaS environment — under Workflows → Rules.

**Rules** is under **Workflows → Rules** in the sidebar at `/workflows/rules`. Rules let you define what events matter and what should happen when they occur — automatically, in real time.

## How rules work

A rule has three parts:

1. **Trigger** — the event type that starts the evaluation
2. **Conditions** — AND-matched filters that narrow which events activate the rule
3. **Actions** — what happens when all conditions match

Rules evaluate in real time as events arrive from your connected integrations.

## Creating a rule

1. Go to **Workflows → Rules**
2. Click **New Rule**
3. Give it a name and optional description
4. Choose a trigger type
5. Add conditions
6. Configure one or more actions
7. Set the rule to **Active** and save

### Trigger types

| Trigger            | What it watches                                                            |
| ------------------ | -------------------------------------------------------------------------- |
| **Account**        | User account events — created, deactivated, last login crossed a threshold |
| **OAuth Grant**    | New grant added, grant risk level changed, grant unused for N days         |
| **Resource (App)** | New app discovered, app risk level, shadow IT detected, app status changed |
| **Event**          | Generic events from integrations — broad catch-all for custom automation   |

### Conditions

All conditions must match (AND logic). Conditions narrow the trigger to specific cases:

**For apps:** category, risk level, shadow IT status, discovery source, approval status\
**For OAuth grants:** risk level, permission scopes, grant age, publisher trust score\
**For users:** group membership, department, directory status, last active date

### Actions

| Action             | What it does                                                                |
| ------------------ | --------------------------------------------------------------------------- |
| **Notify**         | Send an in-app, email, Slack, or Teams notification to specified recipients |
| **Create finding** | Open a new finding with a specified risk level and description              |
| **Assign**         | Assign the resource to a workspace member for review                        |

## Example rules

### Alert on new high-risk shadow IT

* **Trigger:** Resource — New app discovered
* **Conditions:** Approval status = Pending, Risk level = High or Critical
* **Action:** Notify `#security-alerts` Slack channel

### Flag stale OAuth grants

* **Trigger:** OAuth Grant — Not used in N days
* **Conditions:** Days since last use ≥ 90
* **Action:** Create finding (Medium), assign to IT admin

### Watch for deprovisioned users with active access

* **Trigger:** Account — User deactivated in directory
* **Conditions:** User has active app assignments
* **Action:** Notify IT admin + create finding (High)

### Track new AI tools being adopted

* **Trigger:** Resource — New app discovered
* **Conditions:** AI classification = AI Primary or AI Enhanced
* **Action:** Notify IT lead, assign for review

### Trigger an offboarding playbook automatically

* **Trigger:** Account — User deactivated
* **Action:** Trigger Playbooks — Employee offboarding

## Managing rules

**Active / Paused** — toggle rules on or off without deleting them. Useful when you want to temporarily suspend a noisy rule without losing its configuration.

**Rule log** — see a history of every event that triggered each rule and what action was taken. Essential for debugging why a rule did or didn't fire.

**Edit** — modify conditions and actions at any time; changes take effect immediately on the next matching event.

**Duplicate** — create a copy of an existing rule as a starting point for a new one.

## Current limitations

Rules currently support **AND-only** condition matching — all conditions in a rule must match. For OR scenarios (e.g. "alert if risk is High OR Critical"), create two separate rules with each condition.

## Next steps

<CardGroup cols={2}>
  <Card title="Findings" icon="triangle-exclamation" href="/governance/findings">
    Review findings created by rules
  </Card>

  <Card title="Playbooks" icon="list-check" href="/governance/playbooks">
    Trigger multi-step workflows from rules
  </Card>

  <Card title="Pulses" icon="bell" href="/governance/pulses">
    Send employee outreach as a rule action
  </Card>

  <Card title="OAuth Grants" icon="plug" href="/governance/oauth-grants">
    Set up automated alerts on risky grants
  </Card>
</CardGroup>