# Rule templates (/docs/rules/templates)
The fastest way to a working rule is a template. On the Firewall page, hit
**New rule from template** to open the gallery at **Pick a rule to get started**
([app.tokenpolice.ai/firewall/new](https://app.tokenpolice.ai/firewall/new)). The button beside
it, **Custom rule**, opens the builder instead — see
[Filter vs apply-to](/docs/rules/match-vs-groupby).
## How the gallery works [#how-the-gallery-works]
**Pick a card.** Three templates show under **Most common** — *Cap spend per user*, *Stop at a
total spend*, and *Stop free-tier abuse (Sybil attack)*. The rest are behind a **More rules**
toggle. There's a search box and a category filter.
**Fill in the drawer.** A right-hand drawer opens with the template's category, an explanation of
exactly what the rule will do, any warnings, and only the fields that template needs.
**Choose when it starts acting.** Under **When to turn it on**, pick **Dry-run** (the default —
it shows what the rule would do without stopping anything) or **Enforce** (it arms the rule
straight away). Notify templates skip this step, because they never block.
**Click Create rule.** You land back on the Firewall page with the rule in the table.
Templates are maintained by TokenPolice and served fresh, so the gallery always reflects the
current set. The explanation in the drawer is a fixed description of the template; the
**Custom rule** builder is the one that rewrites its preview sentence as you type.
## Limit spending [#limit-spending]
| Template | What it does | Fields |
| ----------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| **Cap spend per user** *(most common)* | Tracks spend separately for each `user_id`; a user is paused only once they personally pass the limit. | Rule name; limit per user (default $10); reset period (default monthly) |
| **Stop at a total spend** *(most common)* | One project-wide total. Once it passes the limit, all calls pause until the period resets — no per-user split. | Rule name; total limit (default $1,000); reset period |
| **Stop free-tier abuse (Sybil attack)** *(most common)* | Adds up spend across **all** users on your free plan into one shared pool, so a flood of fake accounts can't run up a bill. Optionally also creates a second per-user rule. | Rule name; your free plan's name; reset every hour or day; total free-tier budget; optional per-user limit |
| **Cap spend for free users** | Per-user cap that only counts calls on the plan you name. Paid users are untouched. | Rule name; free plan name; limit per free user (default $5); reset period |
| **Cap spend for paid users** | Same, for one named paid tier. Add one rule per tier. | Rule name; paid plan name; limit per user (default $50); reset period |
| **Shared limit for a group** | One shared budget for a single tag value — say `department = support`. Every call with that exact label counts against it. | Rule name; tag; tag value; shared limit (default $200); reset period |
| **Per-user limit within a group** | Each user inside one named group gets their own budget. | Rule name; tag; group value; limit per user (default $5); reset period |
| **Per-user limit for a feature** | Each user gets their own budget for a single named feature. | Rule name; feature; limit per user (default $5); reset period |
| **Give each team or feature its own budget** | You name a tag; **every value** of it gets its own separate budget. Only the value that overspends is paused. | Rule name; tag; limit for each (default $5); resets after N minutes of no spend (default 30) |
| **Limit spending per session** | Each `session_id` your app sets gets its own limit. | Rule name; limit per session (default $5); forget an idle session after N minutes (default 30) |
## Block someone [#block-someone]
| Template | What it does | Fields |
| --------------------------- | ---------------------------------------------------------------------------------------------- | --------------------- |
| **Block free-tier users** | Blocks every call whose `paid_plan` matches the value you enter. No limit — an outright block. | Rule name; which plan |
| **Block one specific user** | Blocks every call from one `user_id`. | Rule name; which user |
## Save money [#save-money]
Every reroute template is **unconditional unless it has a limit**, and swaps stay within the same
provider. Read the [framework caveat](/docs/rules/actions#reroute) before enforcing one.
| Template | What it does | Fields |
| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| **Send free users to a cheaper model** | Every call on the named plan has its model swapped before the call runs. No limit involved. | Rule name; which plan; cheaper model |
| **Switch to a cheaper model after $X** | Project-wide: once total spend passes the limit, later calls run on the cheaper model until the period resets. | Rule name; switch after (default $500); reset period; cheaper model |
| **Switch each team or feature to a cheaper model after $X** | Every value of a tag gets its own threshold; only the value that crosses it is switched. | Rule name; tag; switch after (default $5); resets after N minutes of no spend; cheaper model |
| **Switch a session to a cheaper model after $X** | Once one session passes the limit, its later calls run on the cheaper model. | Rule name; switch after (default $5); forget an idle session after N minutes; cheaper model |
## Just watch [#just-watch]
| Template | What it does | Fields |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| **Alert me when a user overspends** | Tracks spend per `user_id` and sends an alert when a user passes the limit. **Calls are not blocked.** | Rule name; alert me at (default $50); reset period; which channels to notify |
Anything on a **free plan** template applies to calls your app never stamped with a plan too —
the product's own warning is *"A call that doesn't set `paid_plan` is recorded as `free`."* If
you enter `free` and your app misses the plan on some calls, this rule blocks those calls as
well, including calls from paying users. See [Identity](/docs/concepts/identity).
## The duplicate check [#the-duplicate-check]
One template — *Stop free-tier abuse* — checks whether its optional per-user guard would
duplicate a rule you already have, and tells you in the drawer before you create it. No other
template does this, and the gallery itself never checks.
## Changing a template rule afterwards [#changing-a-template-rule-afterwards]
There is no in-place edit. To change a number or a condition, open **Custom rule**, give it the
**same name** as the existing rule (which overwrites it), or delete the rule and create it again
from the template. Names are unique per project, and that is what makes the overwrite work.
## Next [#next]