- Allowed/Disallowed path matching - Cache hit counter assertion - Default-allow on 5xx network error - keyhunter UA matching precedence