Does changing the Rule Creation Policy change existing rules?

Short answer

No. Rule Creation Policy (Learning Methods card; default Data based) determines only whether the AI Learning, Teacher, Learn Selected and Allow / Teach learnings from now on open a new page type. A learning is first written to the existing page type that matches the path of the request; a new page type is opened only when the request falls to the Any Paths rule: Page independent never opens one and the learning is written to Any paths, Data based opens one for the learnings in the Query, JSON, XML, Form and Raw fields and for the allowed method learnings, and Comprehensive adds the path field to these. Header learnings are written to Any paths whatever the policy is. When the policy is changed, the existing page types and Any paths do not change; there is no move or rewrite operation. The blocking of unlearned access arises only when, on applying an analysis run with Create New Rules in Analysis & Learning, Any paths is set up again. Note the reverse direction: when an analysis is applied, the policy is set to the Rule Creating Mode selected in the analysis without being asked separately.

The Effect of the Policy

Policy (name in the form)	Fields for which a new page type is opened in a learning that falls to Any Paths	Card sentence
Page independent (Pages are not learned)	None; the learning is written to Any paths	Rule policy is Page independent — pages are not learned individually; access is governed by one general rule
Data based (Pages with dynamic data are learned) · default	Query, JSON, XML, Form, Raw and the allowed methods	Rule policy is Data based — unlearned accesses carrying data are blocked
Comprehensive (Each page is learned)	The above and path	Rule policy is Comprehensive — any access outside the learned pages is blocked

• The learning in a request that matches an existing page type is written to that page type under every policy.
• A header learning is written to Any paths under every policy (Why are rules learned from headers written to the Any Paths rule rather than per page?).
• The card sentences describe the effect of the policy after an analysis made with Create New Rules; changing the policy does not produce this effect by itself.
• The policy is changed in the Learning Methods window and saved with Edit; there is no separate deployment step. In WEB-CLI, the field is --createRulePolicy; the values are loose (Page independent), onlyVar (Data based) and strict (Comprehensive):

waf options update poolId <vService> --createRulePolicy onlyVar

• Mode selection in the analysis: What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?

Common Misconceptions

• "Setting the policy to Comprehensive immediately blocks unlearned pages." The existing rules do not change; the effect comes with applying an analysis made with Create New Rules.
• "The policy changes only manually." Applying an analysis sets the policy to the mode selected in the analysis.
• "In Page independent, all learnings are written to Any paths." If the request matches an existing page type, the learning is written to that page type; it is just that no new page type is opened, and the learning in a request that does not match is written to Any Paths.

How it is done in the documentation

• Learning Methods · Rule Creation Policy
• Learning Methods · The Learning Methods Card on WAF Management
• Analysis & Learning · Rule Creating Mode
• WEB-CLI waf options · Rule Management and Sampling

Related questions

• What is the difference between the Rule Creating Mode options (Comprehensive, Data Based, Page Independent); which one should I choose?
• Should I fix a false positive for a single parameter only or for the whole page?
• Why are rules learned from headers written to the Any Paths rule rather than per page?