# Detection Rules The **Detection Rules** page catalogs the detectors that power [risk policies](/docs/ai-control-plane/secure/risk-policies). Open it from **Secure > Detection Rules** in the dashboard. ## Access requirements Viewing this page requires the `org:admin` scope. Access is included in the [default Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) but not the Member role. ## Built-in rules Built-in detectors are grouped by category: secrets, financial data, PII, government IDs, healthcare data, shadow MCP, destructive tool use, account identity, and prompt injection. Expanding a category lists its individual rules; clicking a rule opens a detail sheet, and rule detail views are deep-linkable for sharing. ## Custom rules Custom rules extend detection beyond the built-ins: - Write the match logic as a CEL expression in an editor with syntax highlighting and worked examples - Assign the rule a category and a severity level - Rule IDs are prefixed `custom.` and validated on save An AI suggestion action drafts a rule from a plain-language description of what to detect. ## Testing rules The test flow runs a rule against a selected chat session and shows exactly what it matches, so a rule can be validated against real traffic before it's attached to a policy.