The rulesets provided with your application are locked against change, so you must first create a ruleset to hold the customization and configuration for your organization. You then add the personalized ruleset to each access group that has users that need the ruleset; adding your ruleset to the top of each access group’s ruleset list ensures that the rule resolution process finds customized rules first.