# How do I review a rule before it applies?

> provely rules review lists and edits every rule, with who wrote it and its status. A person signs each change that needs a signature.

Canonical: https://provely.sh/rules/review  
Last updated: 2026-10-18  

**Rules are optional. With the two lines and no rules file, Provely builds the checks for each agent at run time (just in time), from the tools it finds. Run `provely rules review` to list and edit each rule.**

The static compiler (`provely rules scan`, `review` and `sign`) is for when you want more. Audit the plan before it runs. Share it with your team in git, or in your Provely account with `provely rules sync`. Make exceptions for an agent or a tool: skip a check, mark a read-only tool, or set a timeout. Some exceptions need a signature.

The review lists each rule, who wrote it, and its status. A change that needs a signature waits until a person signs it.

Rules and markers reach a check run in: TypeScript frameworks (sdks/typescript/src/defenses/runtime.ts:656, commit 5a8f6a6c); Python frameworks (sdks/python/src/provely/frameworks.py:637, commit d4fe6faf); TypeScript plain SDKs (sdks/typescript-instrumentations/src/plain-sdk.ts:249, commit e9aa6a40); Python plain SDKs (sdks/python-instrumentations/src/provely_instrumentations/plain_sdk.py:297, commit e9aa6a40). These callers are not yet in the SDK commit 4112bb06, where the settings and markers come from. On the Python frameworks paths, the grid at commit d4fe6faf passes 5 of 6 rules cases on every path. Read [the rules cases](/frameworks#rules-cases). The rules cases are not yet measured at the current heads for: TypeScript frameworks, TypeScript plain SDKs, Python plain SDKs.

Source: https://provely.sh/rules (retrieved 2026-10-17)

*terminal*

```bash
$ provely rules scan
$ provely rules review
$ provely rules sign
```

In CI, run `provely rules review --check`. It exits 10 when a rule does not apply, and it writes a Markdown summary.

## What does the review list?

- Each rule, with the agent or the tool it names.
- Who wrote it: your code, the scan, the learner, or a person.
- Its status: applied, waiting for signature, void, or refused.
- For a void rule, the reason: expired, changed code, or unknown name.

## Who may sign?

A person with a signing key. `provely rules keys` manages the keys. A signature from a key that the project does not trust signs nothing.

## What happens when the code changes after a signature?

The signed rule becomes void with the reason changed code, and the default holds again. Sign the rule again after you review the change.

## Can a signature change any check?

No. Three checks can never change, signed or not. Read [the list](/rules).

## How do rules reach my organisation?

`provely rules sync` copies rules between `.provely` and your organisation, by the API key. The rule keeps its signature, and the status rules are the same in every source.

## Read next

- [Read the rules reference](https://provely.sh/rules)
- [Learn rules from failures](https://provely.sh/rules/learning)