> For the complete documentation index, see [llms.txt](https://docs.radiusaas.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.radiusaas.com/admin-portal/access-and-rules/rules.md).

# Rules

This is the documentation of the RADIUSaaS Rule Engine, which allows you to add another layer of security by defining rules that further restrict network access requests or by assigning VLAN IDs.

## General 

The Rule Engine is a second layer of security that sits behind credential authentication. Once a device or user presents a valid **certificate** (checked against your **Trusted Roots**) or a valid **Username/Password** pair, the Rule Engine decides whether that specific request is actually allowed onto the network, and what it receives in return, such as a VLAN ID or additional RADIUS attributes.

### Default rule

To avoid disruption of any existing instance or in case you do not want to use the Rule Engine at all, any authentication is allowed if no rule is defined by default. This is realized through our default rule **Any authentication allowed**.

{% hint style="warning" %}
The default rule **Any authentication allowed** still requires the presence of valid authentication credentials for a successful network authentication.
{% endhint %}

### Order of rule execution

Every incoming request is checked against your enabled rules from top to bottom. The first rule whose **medium**, **authentication method** and **filters** all match the request wins, and decides the outcome. Rules positioned below that match are never evaluated for that request.

If you have multiple rules configured, they will be applied in the order you see in your web portal - from top to bottom. 

The only exception is the **Any authentication allowed** rule, that will be handled as last step in case it is configured. This is especially helpful during a ramp-in scenario, where you might not be certain that your rules cover all use-cases or locations. All authentication request rejected by the prior rules will then still be accepted by the default rule. In the dashboard you are then able to observe the devices/users failing for all other rules and correct/extend the rules accordingly. 

In case you end up having a large number of rules, we recommend - for the sake of maintaining high performance - to order the rules in a way that the most likely rules are hit first.

## More Information

Find more details on the rules and how to use them in the following pages:

{% content-ref url="/pages/c4M1f9uiuAyD5RqWmtnG" %}
[General Structure](/admin-portal/access-and-rules/rules/general-structure.md)
{% endcontent-ref %}

{% content-ref url="/pages/Z7cPtVJJOK1Xtn9V5Pqk" %}
[Groups](/admin-portal/access-and-rules/rules/groups.md)
{% endcontent-ref %}

{% content-ref url="/pages/fCFu0Mb5hbAe21eqB7p6" %}
[Certificate Extensions](/admin-portal/access-and-rules/rules/certificate-extensions.md)
{% endcontent-ref %}

{% content-ref url="/pages/nr8htn2giI38d0uKa82w" %}
[Attribute Catalogue](/admin-portal/access-and-rules/rules/attribute-catalogue.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.radiusaas.com/admin-portal/access-and-rules/rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.