[rules-users] incomplete audit?