Contoso Logistics: rule order, per-user safe senders, and a quarantine that swallows supplier invoices

(a) Quarantined, and R2 never runs. R1 matches on subject regardless of sender, its action is quarantine, and 'stop processing' means evaluation ends there. The AP allowlist sitting at R2 is dead configuration - it can never fire for any message that R1 catches, which is exactly the traffic it was written for.

(b) Delivered to the inbox. The per-user safe-sender entry is evaluated before the rule set, so mail from supplier-b.example bypasses R1 for those 12 mailboxes. This explains the 'a few people still get them' observation precisely: 12 mailboxes out of the whole AP group.

(c) Quarantined. No safe-sender entry, so the message falls through to R1 and stops there. This is why the experience looks inconsistent to the AP manager - the same supplier succeeds or fails depending on a per-mailbox setting nobody documented.

(d) Quarantined. This is the one behaviour you must preserve: the subject-only rule is crude but it is currently catching real invoice fraud.

Diagnostic point. Every symptom here follows from two facts - ordering plus a stop action, and a per-user exception layer that outranks the rule set. Note also that a domain-level allowlist is a weak control: supplier-a.example in the From field is trivially spoofable unless you also require an authentication pass, which R2 as written does not.

Keep one authoritative rule rather than an allow-rule behind a stop-rule. Fold the exception into R1 as a condition group:

• R1 'InvoiceHandling' - inbound, subject matches the invoice pattern.
  • Exception (evaluate first): sender domain in the approved supplier list AND DMARC pass with SPF or DKIM alignment (not merely 'SPF pass') AND recipient in ap-team@ → continue to R3 and deliver, tagging X-Supplier-Verified: yes.
  • Otherwise → quarantine, notify ap-team@ by digest, stop.

Remove or explicitly re-scope R2. Leaving a redundant allow rule in place after the exception logic invites the same drift on the next edit. Delete it and document the exception inside R1.

Retire the per-user safe-sender entries for supplier-b.example, or convert them into the authenticated group-level exception. Per-user exceptions are invisible to the next administrator and produce exactly this class of 'intermittent' failure.

Similarly fix R3's placement. Bulk mail tagged and then allowed to continue does nothing useful; make the action a route to a bulk destination if that is the intent, otherwise drop the rule.

Validation before rollout.

1. Clone the rule set into a business-unit or test scope with a small pilot group plus three seeded mailboxes.
2. Send controlled samples from each of the four classes above, including a spoofed supplier-a message sent from an unauthorised IP.
3. Confirm outcomes in message tracking by rule name - verify the rule hit, not just the final disposition.
4. Run a two-week parallel period where the new rule only tags and reports instead of quarantining, then flip to enforcement.
5. Keep a rollback: export the rule set before editing, and record the ticket.

What it buys. Broader subject coverage catches BEC subjects that avoid the word 'invoice' - 'urgent wire request' is a genuine gap in the current pattern.

What it costs.

• False-positive volume scales with match breadth. Adding 'statement' and 'balance' pulls in bank statements, payroll notifications, vendor onboarding and internal finance traffic. At 180,000 messages/day, a rule that misfires on 0.1% is 180 quarantines daily, and each one costs someone a release decision.
• Adversary adaptation is cheap. Subject keywords are attacker-controlled and free to change; the pattern will always lag by a release cycle.
• 'Urgent' is nearly content-neutral and would catch large volumes of legitimate reminder mail from ticketing and HR systems.

Better use of the same effort. Keep the subject rule as a narrow safety net and add independent conditions that are costly for an attacker to forge: DMARC failure on the sender domain, first-time sender for the recipient, display name matching an executive or supplier contact, reply-to domain differing from From, domain age under 30 days, and newly registered lookalike domains. Weighted conditions degrade gracefully; a keyword list only gets broader or narrower.

If the regex is expanded anyway, the defensible version is: quarantine only when a keyword match co-occurs with an authentication failure or a first-contact sender, and route the matched-but-authenticated cases to a review queue rather than quarantine. Then measure for two weeks in tag-only mode before enforcing - and publish the quarantine-reason string so the service desk can triage 'why was my statement held' without escalating to the mail team.