diff --git a/CVE-CHANNEL.md b/CVE-CHANNEL.md
index 75ff5db..926ba3b 100644
--- a/CVE-CHANNEL.md
+++ b/CVE-CHANNEL.md
@@ -13,6 +13,34 @@ Engine 3.0.47 and later fetch it hourly from:
 
     https://git.artica.center/Andre/edgeguard-owasp-feed/raw/branch/main/cve.json
 
+## When a rule belongs here, and when it does not
+
+This document reaches every customer's agents from one hardcoded URL, so a
+publish is a decision taken on their behalf. It earns that only in a narrow
+case: **an actively exploited vulnerability, recognisable in a single request,
+in software customers run, during the days before a real fix exists.** That is
+a few a year.
+
+Entry and exit, so rules do not accumulate because publishing is easy:
+
+1. **In as `log`.** It records matches and scores nothing, so it refuses
+   nothing while you see what it would have caught.
+2. **Promoted to `critical` only with a reason.** Severity is what acts —
+   `high` scores 4 against a default threshold of 5 and does nothing on its
+   own. A rule left at `high` is inert, not cautious.
+3. **Then out.** Anything still worth enforcing after the emergency moves into
+   the engine, where it works with no network and cannot be withdrawn by a bad
+   publish — Log4Shell, Spring4Shell and PHP2Shell all live there. Anything no
+   longer worth it is deleted and the stamp bumped.
+
+A rule sitting here indefinitely is in the wrong place.
+
+**And customers do not need this channel for their own rules.** Create Custom
+Ruleset in the console takes the same fields and reaches their agents through
+the configuration pull, scoped to the sites they choose. The config pull is
+forbidden from touching the sources this feed owns and this feed is forbidden
+from touching theirs, so the two cannot clear each other.
+
 ## Publishing a patch
 
 Add a rule to the single ruleset, bump `build_datetime`, commit, push. An