I kept the rules that were already in the source, like the two-business-day follow-up, the signed-scope check, and the instruction not to put credentials in the project doc. When the source didn't answer something, I left it open instead of making up a rule.