Audit rules overview

PowerToolBox runs 20 audit rules in six categories. Each rule produces findings with a severity, a category, remediation guidance, and a confidence value. Findings feed the per-flow risk score.

The rules

ID	Name	Category	Default severity
SEC-01	Hardcoded Secret	Security	Critical
CON-04	Tenant Isolation Bypass	Security	Critical
SEC-04	Direct Connection Usage	Security	High
RPA-01	PAD Not Patched	Security	Medium
EXF-02	Email Exfiltration	Exfiltration	High
EXF-03	HTTP Exfiltration Risk	Exfiltration	High
EXF-04	Anonymous File Sharing	Exfiltration	High
DLP-01	Child Flow DLP Bypass	Governance	High
OWN-01	Orphaned Flow	Governance	Medium
OWN-03	Admin Account Ownership	Governance	Medium
HYG-02	Default Environment Usage	Governance	Low
PERM-01	Flow Over-Sharing	Governance	Medium
CON-02	Premium Connector Unlicensed	Governance	Medium
DLP-04	Unclassified Connector	Governance	Medium
RES-01	Missing Try-Catch Pattern	Operational	Medium
RES-03	Missing Error Notification	Operational	Medium
PER-10	Auto-Shutdown Risk	Operational	Medium
LOG-03	Run History Retention	Compliance	Low
AI-03	AI Connector Unclassified	AI	High
AI-04	Copilot Excessive Privilege	AI	High

How rules inspect a flow

Rules work at four levels:

Flow definition rules parse the flow JSON itself: actions, inputs, connectors. Examples: SEC-01, EXF-03, RES-01.
Metadata rules check ownership, environment type, and similar properties. Examples: OWN-01, HYG-02.
Cross-reference rules compare the flow’s connectors against the tenant’s DLP policies. Examples: DLP-01, DLP-04, AI-03.
Run history rules evaluate past runs. Example: PER-10.

In 1.2.0 the scan collects flow definitions only — not owners, DLP policies, or run history. Cross-reference and run-history rules are affected: OWN-01, DLP-04, AI-03, and HYG-02 fire on every flow or connector, while OWN-03, DLP-01, PERM-01, PER-10, and LOG-03 cannot fire. Definition-based rules are unaffected. See Known limitations in 1.2.0.

Toggling categories

In appsettings.json next to the executable (or through PowerToolBox_ environment variables):

{
  "Rules": {
    "CategoryToggles": {
      "Security": true,
      "Governance": true,
      "Operational": true,
      "Compliance": true,
      "AI": true,
      "Exfiltration": true
    }
  }
}

Set a category to false to skip all of its rules. Restart the app to apply.

Overriding severity

Change the severity of individual rules by rule ID. Valid values: Critical, High, Medium, Low, Informational.

{
  "Rules": {
    "SeverityOverrides": {
      "EXF-03": "Critical",
      "SEC-01": "High"
    }
  }
}

An override changes the base points a finding contributes to the risk score.

Last updated: July 27, 2026