# Evaluation Policies and Batch Validation

MoonRule separates rule outcomes from the acceptance policy applied by an embedding service.

## Severity thresholds

`RuleEvaluationOptions` supports three thresholds:

- `AnyFailure`: every failed rule rejects the input;
- `WarningOrHigher`: informational failures are advisory;
- `ErrorOnly`: only `Error` rules reject the input.

Runtime and type errors always reject the input because no reliable boolean decision was produced.

```moonbit nocheck
let report = rules.evaluate_with_options(
  input,
  {
    failure_threshold: ErrorOnly,
    stop_on_blocking_failure: false,
    stop_on_evaluation_error: true,
  },
)
```

`PolicyReport` distinguishes blocking failures from advisory failures and records whether evaluation stopped early.

## Batch validation

A compiled `RuleSet` can be reused across an array of JSON records:

```moonbit nocheck
let report = rules.evaluate_batch(
  records,
  options={
    rule_options: RuleEvaluationOptions::default(),
    stop_on_first_rejected_record: false,
  },
)
```

The aggregate report records requested, evaluated, accepted, and rejected counts plus a detailed report for each zero-based input index.

Command-line use:

```text
moon run cmd/main -- check-batch \
  examples/access-rules.json \
  examples/users-batch.json
```

## Untrusted configuration

`RuleSet::compile_with_limits` and `RuleSet::from_json_with_limits` can enforce:

- maximum number of rules;
- maximum name and message lengths;
- unique rule names;
- maximum combined expression source;
- the existing per-expression `CompileLimits`.

These checks complement `EvaluationLimits`, which stops execution after a configured number of visited AST nodes.