No static rules blocking blindly. Each HTTP request is analyzed semantically by the AI in milliseconds: block, challenge, quarantine or pass. OWASP CRS is input, AI is the decision-maker.