RuleSpoolWhat the explorer adds
A native resolved JSON listing is valuable input. The explorer adds a per-resource trace of action and resource matches, the final matching rule, the configured-deny checkpoint and a comparison of the original snapshot with your draft. The request set stays the same on both sides of a review.
The four starting examples cover a misplaced exception, a saved approval that cannot bypass a deny, a two-path patch and platform-dependent path matching. They are deliberately synthetic. You can replace them with your own bounded rule arrays and actual request strings.
What it costs to use
The tool is free. Its analysis runs in your browser and the pages are hosted on Cloudflare. No account, model key, paid external API, subscription or checkout is required. Optional export fetches only fixed replay source assets from this site.
It is not a replacement for running your application's tests or reviewing security policy. The source pin and method make the scope explicit, and every displayed effect is labeled as a result for the supplied layers.
Independent identity
RuleSpool is not an official OpenCode, Anomaly, Cloudflare or browser-vendor service. Product names identify the software contract being examined. The site does not represent any previous operator or organization associated with this domain.
Our staging acceptance guide promotes related WebTraceCheck and CleanTempMail products for one concrete own-application workflow. Those services are optional, and their results are separate from the permission analysis.
Report a reproducible mismatch
Include the relevant source or installed version, selected platform and a minimized synthetic rule/request case. A screenshot of an “allow” label alone is not enough to identify the input or evaluation stage. Send a concise report to support@cleantempmail.com. Do not send credentials, private command arguments or full provider configuration.