A WAF rule is not authorization

A web application firewall can block known attack patterns, bad bots, and noisy paths. Authorization still decides whether this principal may perform this action on this object. Treating a green WAF v