{
  "version": 1,
  "rule_groups": [
    {
      "name": "Sample Rule 3",
      "rules": [
        {
          "priority": 100,
          "name": "Delete if there are 20 or more external addresses",
          "action": {
            "type": "delete",
            "attribute": {},
            "notifies": [
              {
                "type": "notify_sender"
              }
            ]
          },
          "predicate": "and",
          "predicates": [
            {
              "target": "header:tocc:address",
              "predicate": "not-match",
              "pattern": "@example\\.com$",
              "count": 20
            },
            {
              "target": "envelope:from",
              "predicate": "not-approver",
              "pattern": "Sample GroupC"
            }
          ]
        },
        {
          "priority": 110,
          "name": "Emails containing specific keywords require approval",
          "action": {
            "type": "request_approval",
            "attribute": {},
            "notifies": [
              {
                "type": "notify_sender"
              },
              {
                "type": "notify_approver"
              }
            ]
          },
          "predicate": "and",
          "predicates": [
            {
              "target": "body",
              "predicate": "match",
              "pattern": "Confidential|Strictly Confidential",
              "count": 1
            },
            {
              "target": "envelope:from",
              "predicate": "not-approver",
              "pattern": "Sample GroupC"
            }
          ]
        },
        {
          "priority": 120,
          "name": "Approval required if there are more than 3 external domains",
          "action": {
            "type": "request_approval",
            "attribute": {},
            "notifies": [
              {
                "type": "notify_sender"
              },
              {
                "type": "notify_approver"
              }
            ]
          },
          "predicate": "and",
          "predicates": [
            {
              "target": "header:tocc:domain",
              "predicate": "not-match",
              "pattern": "^example\\.com$",
              "count": 3
            },
            {
              "target": "envelope:from",
              "predicate": "not-approver",
              "pattern": "Sample GroupC"
            }
          ]
        },
        {
          "priority": 130,
          "name": "Approval required for emails with attachments",
          "action": {
            "type": "request_approval",
            "attribute": {},
            "notifies": [
              {
                "type": "notify_sender"
              },
              {
                "type": "notify_approver"
              }
            ]
          },
          "predicate": "and",
          "predicates": [
            {
              "target": "attachment",
              "predicate": "attachment-exist",
              "count": 1
            },
            {
              "target": "envelope:from",
              "predicate": "not-approver",
              "pattern": "Sample GroupC"
            }
          ]
        }
      ]
    }
  ]
}