version: 1
rule_groups:
- name: Sample Rule 3
  rules:
  - priority: 100
    name: Delete if there are 20 or more external addresses
    action:
      type: delete
      attribute: {}
      notifies:
      - type: notify_sender
    predicate: and
    predicates:
    - target: header:tocc:address
      predicate: not-match
      pattern: '@example\.com$'
      count: 20
    - target: envelope:from
      predicate: not-approver
      pattern: Sample GroupC
      count: 0
  - priority: 110
    name: Emails containing specific keywords require approval
    action:
      type: request_approval
      attribute: {}
      notifies:
      - type: notify_sender
      - type: notify_approver
    predicate: and
    predicates:
    - target: body
      predicate: match
      pattern: Confidential|Strictly Confidential
      count: 1
    - target: envelope:from
      predicate: not-approver
      pattern: Sample GroupC
      count: 0
  - priority: 120
    name: Approval required if there are more than 3 external domains
    action:
      type: request_approval
      attribute: {}
      notifies:
      - type: notify_sender
      - type: notify_approver
    predicate: and
    predicates:
    - target: header:tocc:domain
      predicate: not-match
      pattern: ^example\.com$
      count: 3
    - target: envelope:from
      predicate: not-approver
      pattern: Sample GroupC
      count: 0
  - priority: 130
    name: Approval required for emails with attachments
    action:
      type: request_approval
      attribute: {}
      notifies:
      - type: notify_sender
      - type: notify_approver
    predicate: and
    predicates:
    - target: attachment
      predicate: attachment-exist
      pattern: ""
      count: 1
    - target: envelope:from
      predicate: not-approver
      pattern: Sample GroupC
      count: 0
