Building allow and block rules with CIDR and domain patterns

Rules give you deterministic control on top of the model score.

• Block an email domain you never want (block email domain = mailinator.com).
• Allow a trusted office or partner IP range using CIDR notation, e.g. 3.0.0.0/8, so your own staff testing a form are never held up.
• Block by country or by a specific reason code where that fits your risk appetite.

Set each rule at the right scope — global, account, domain or a single form — so a broad block does not catch a form where that pattern is legitimate. Because rules can override the score, use them for your known-good and known-bad lists and let the model handle everything in between.