Allow, ask and deny. They are evaluated in a fixed order that surprises most people, and getting that order wrong is how a rule you wrote does nothing.
None of these throw an error. That is what makes them expensive: a file that does nothing, a rule that is not a boundary, and a job that finishes clean having done no work.
