Block

Block rules are for known-unacceptable values or patterns.

Watch

Watch rules add scrutiny/risk without necessarily refusing the event outright.

Allow

Allow rules can document trusted values, but should be used carefully—an allowlist should not become a blanket bypass for unrelated fraud signals.