Block
Block rules are for known-unacceptable values or patterns.
Watch
Watch rules add scrutiny/risk without necessarily refusing the event outright.
Allow
Allow rules can document trusted values, but should be used carefully—an allowlist should not become a blanket bypass for unrelated fraud signals.