SEND governs who this org's agents may email (enforced when a send is attempted); RECEIVE governs whose mail is accepted for them (enforced at ingest, before the message is stored or any webhook fires). Reply-scope is not implemented.

BLOCK refuses the matching address. ALLOW does two things: it carves an exception out of a broader BLOCK, AND it switches that scope+direction into allow-list mode — once any ALLOW rule exists, addresses it does not cover are refused. Adding one ALLOW rule therefore restricts far more than it permits.

ADDRESS matches one exact address. DOMAIN matches the domain and its subdomains ('example.com' covers 'a@mail.example.com' but never 'a@notexample.com'). ADDRESS beats DOMAIN when both match.

The address or domain this rule matches. Normalized to lowercase. Validated against patternType.

Scope the rule to one agent. Omit or null for an org-wide rule. An agent's own rules take precedence over org-wide rules — including its allow-list, which does NOT inherit the org's.

Optional operator note ('known phisher', 'competitor'). Surfaced in the error a blocked send returns and in the security event, so a refusal is diagnosable without opening the console.

Unique identifier of the rule

SEND governs who this org's agents may email (enforced when a send is attempted); RECEIVE governs whose mail is accepted for them (enforced at ingest, before the message is stored or any webhook fires). Reply-scope is not implemented.

BLOCK refuses the matching address. ALLOW does two things: it carves an exception out of a broader BLOCK, AND it switches that scope+direction into allow-list mode — once any ALLOW rule exists, addresses it does not cover are refused. Adding one ALLOW rule therefore restricts far more than it permits.

ADDRESS matches one exact address. DOMAIN matches the domain and its subdomains ('example.com' covers 'a@mail.example.com' but never 'a@notexample.com'). ADDRESS beats DOMAIN when both match.

The normalized (lowercase) address or domain this rule matches

The agent this rule is scoped to, or null for an org-wide rule

Operator note, or null if not set

Timestamp when the rule was created

Timestamp when the rule was last modified