> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreflux.org/llms.txt
> Use this file to discover all available pages before exploring further.

# RULE Overview

> Define access control, permissions, and governance rules for your MQTT infrastructure

## Securing Your Broker

Rules define **who can do what** in your Coreflux broker. They control access to system operations, topic publishing/subscribing, and administrative functions—ensuring only authorized users can perform sensitive actions.

> [!TIP]
>
> **Think of Rules like a security guard at a building entrance.** The guard checks your badge (permissions or group) and decides if you're allowed through the door (the operation). Rules do the same for every broker operation.

***

## When to Use Rules

| Scenario | Rule Type |
| - | - |
| Restrict who can create/delete users | User Management Rules |
| Control who deploys Actions, Models, Routes | Entity Management Rules |
| Limit access to system configuration | System Configuration Rules |
| Secure MQTT topic access by user or group | Publish/Subscribe Rules + [RBAC](./rbac) |
| Protect administrative `$SYS` topics | System Topic Rules |

For groups, precedence (**lower priority number wins**), default rules, and Visu panel access, see [RBAC with LoT Rules](./rbac).

***

## In This Section

* [Rules Syntax](./syntax) — Conditions, scopes, and patterns
* [RBAC with LoT Rules](./rbac) — Groups, precedence, cookbook, Visu access

***

## How to Deploy a Rule

Rules can be deployed in two ways: through a **LoT Notebook** (recommended) or via **MQTT commands**.

> [!NOTE]
>
> Custom topic and management ACL rules (`-addRule`) require a **Growth or Enterprise** license. Shipped default rules always apply.

**LoT Notebook**

Write your rule definition in a code cell and run it—the extension detects `DEFINE RULE` and sends the proper command to the broker.

```lot wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" THEN
        ALLOW
    ELSE
        DENY
```

> [!TIP]
>
> Click the **Run** button. The notebook recognizes the LoT code and deploys it instantly.

This approach is ideal for:

* Developing and testing rules interactively
* Documenting your security configuration alongside the code
* Sharing rule sets with your team as `.lotnb` files

**MQTT Command**

Deploy rules by publishing to the broker's command topic using any MQTT client.

**Topic:** `$SYS/Coreflux/Command`

**Payload:**

```bash wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
-addRule DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" THEN
        ALLOW
    ELSE
        DENY
```

Subscribe to `$SYS/Coreflux/Command/Output` to receive the response confirming deployment.

***

## Removing Rules

Remove a rule by name using the `-removeRule` command. Publish to `$SYS/Coreflux/Command`:

```bash wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
-removeRule Zone1Access
```

> [!NOTE]
>
> You can also use the **Coreflux Entities** panel in VS Code to view and remove deployed rules. Locked built-in system rules cannot be removed.

***

## Updating Rules

To update an existing rule, deploy a new rule with the **same name**. The new definition replaces the existing one.

```lot wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
-- Original rule
DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" THEN
        ALLOW
    ELSE
        DENY

-- Updated rule (same name, also allow supervisors)
DEFINE RULE Zone1Access WITH PRIORITY 100 FOR Subscribe TO TOPIC "zone1/#"
    IF USER IN GROUP "zone1-staff" OR USER IN GROUP "supervisors" THEN
        ALLOW
    ELSE
        DENY
```

***

## Viewing Active Rules

To see all deployed rules, subscribe to the rules system topic:

```bash wrap theme={"theme":"css-variables","languages":{"custom":["/languages/lot.json"]}}
SUBSCRIBE "$SYS/Coreflux/Rules/#"
```

Or use the **Coreflux Entities** panel in VS Code if you have the LoT Notebooks extension installed.

***

## Default Rules Reference

Coreflux ships two tiers of defaults:

| Tier | Behavior |
| - | - |
| **Locked system rules** | Management gates and `$SYS` access in the reserved band (`0–99`) — cannot be removed or overridden |
| **Seed catch-alls** | Priority `1 000 000` allow-all for connect, publish, and subscribe so clients keep working; the weakest band, so any custom rule overrides them |
| **Root backstop** | `root` can always recover command and rule management access |

Custom rules use priorities from `100` to `1 000 000`. **Lower priority number wins**; ties deny-wins; no match means deny. Details: [RBAC with LoT Rules](./rbac).

***

## Next Steps

> **[RBAC with LoT Rules](/v2.14/lot-language/rules/rbac)**
>
> Groups, precedence, cookbook, and Visu panel access.

> **[Rules Syntax](/v2.14/lot-language/rules/syntax)**
>
> Conditions, scopes, and complete rule patterns.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.