---
title: "Rules and path policy"
description: "How request rules and path matching work on an adult CDN: per-workload policy for manifests, segments, and images, rule ordering, and avoiding rule sprawl."
url: "https://adultinfra.com/docs/cdn/rules-and-path-policy/"
dateModified: "2026-09-12"
---

[Home](https://adultinfra.com/) / [Docs](https://adultinfra.com/docs/) / Delivery and CDN 

# Rules and path policy

How request rules and path matching work on an adult CDN: per-workload policy for manifests, segments, and images, rule ordering, and avoiding rule sprawl.

LAST REVIEWED 2026-09-13

ON THIS PAGE

- [How a rule matches](https://adultinfra.com/docs/cdn/rules-and-path-policy/#how-a-rule-matches)
- [Per-workload policy](https://adultinfra.com/docs/cdn/rules-and-path-policy/#per-workload-policy)
- [Rule ordering and precedence](https://adultinfra.com/docs/cdn/rules-and-path-policy/#rule-ordering-and-precedence)
- [Avoiding rule sprawl](https://adultinfra.com/docs/cdn/rules-and-path-policy/#avoiding-rule-sprawl)
- [Where AdultInfra fits](https://adultinfra.com/docs/cdn/rules-and-path-policy/#where-adultinfra-fits) 

A **rule** is a conditional override on a resource: when a request matches its condition, the rule’s settings replace the resource defaults for that request. Rules are how one resource can cache a video segment for a week, a live manifest for three seconds, and an API response not at all, without splitting into three separate resources.

This page covers how rules match, how to shape per-workload policy, and how to keep a rule set from becoming unmaintainable. It assumes the resource and caching model from the [CDN overview](https://adultinfra.com/docs/cdn/cdn-overview/) and [Cache control and cache keys](https://adultinfra.com/docs/cdn/cache-control/).

## How a rule matches

A rule condition is a predicate over the request. The usual building blocks are:

- **Path prefix:** everything under `/hls/` or `/media/`.

- **Exact path:** one known endpoint such as `/healthz`.

- **Extension:** `.ts`, `.m4s`, `.mp4`, `.m3u8`, `.jpg`.

- **Query presence or value:** for example a `format` parameter that genuinely changes the object.

- **Method, header, or cookie:** rarely, and usually only for access decisions rather than caching.

Conditions compose with AND, and a rule may carry several independent actions at once: cache lifetime, cache-key behaviour, response headers, redirect, access check, or origin selection. Treat each action as its own axis rather than thinking of “the rule” as one monolithic thing.

## Per-workload policy

The same hostname often serves several workloads, so policy is best expressed per object class rather than per title.

Workload Cache key Typical TTL Range handling Notes VOD manifests ( .m3u8 , .mpd ) Path only Minutes to hours n/a Rewritten on repackage; short TTL Live manifests Path only 1–5 seconds n/a Must track the live edge Media segments ( .ts , .m4s , .mp4 ) Path only Days to weeks Honour ranges Immutable; long TTL is free offload Thumbnails and posters Path, plus transform params Hours to days n/a Version filenames where possible API and personalized JSON Path, plus explicit params Seconds or uncacheable n/a Correctness over offload 

Keep authentication out of every cache key and validate entitlement separately. See the secure-token guidance in [Cache control and cache keys](https://adultinfra.com/docs/cdn/cache-control/). Extension-based rules are convenient but must never be the only thing deciding cacheability, because a dynamic URL can be dressed up to look static.

## Rule ordering and precedence

Rules are evaluated in order and the **first matching rule wins**; once a request matches, later rules do not apply unless the engine explicitly supports additive actions. That single fact drives the whole layout:

- **Most specific first.** Exact paths and security overrides go above broad prefixes.

- **Catch-alls last.** A final low-priority rule should set the safe default for anything unmatched.

- **Resource defaults underneath.** Anything no rule touches falls back to the resource-level settings.

When two rules could match, precedence is decided by position, not by specificity. Reordering rules therefore changes behaviour for live traffic, so treat rule order as part of the review surface in change control.

## Avoiding rule sprawl

Rule sets rot when every new title, campaign, or client gets its own rule. Symptoms: hundreds of near-duplicate entries, unknown owners, and edits that break an unrelated path.

- **Match classes, not instances.** One rule for all `.m4s` under a prefix beats a rule per series.

- **Name and describe every rule.** An unnamed rule is unownable.

- **Generate rules from templates.** Path policy is a good fit for infrastructure-as-code; see [Terraform and control-plane automation](https://adultinfra.com/docs/cdn/terraform-and-automation/).

- **Delete on expiry.** Campaign and one-off rules should carry an owner and an end date.

- **Review order after any insert.** A new broad rule placed too high can shadow everything below it.

## Where AdultInfra fits

Adult catalogues are long-tailed and volatile, so the goal is a small, ordered, class-based rule set that survives rapid publishing. AdultInfra reviews and tunes path policy against your real request mix (manifests, segments, images, and API) rather than a generic template. If you have a hostname and a workload that keeps misbehaving, start with [Adult video CDN](https://adultinfra.com/adult-video-cdn/) or [contact us](https://adultinfra.com/contact/).

**Need this configured for your platform?** [Get a test plan](https://adultinfra.com/contact/) and an engineer will map the resource, cache, and delivery design to your workload.

```json
{"@context":"https://schema.org","@graph":[{"@type":"TechArticle","headline":"Rules and path policy","description":"How request rules and path matching work on an adult CDN: per-workload policy for manifests, segments, and images, rule ordering, and avoiding rule sprawl.","url":"https://adultinfra.com/docs/cdn/rules-and-path-policy/","dateModified":"2026-09-13","keywords":"adult CDN rules, path policy, per-path caching, rule ordering, video manifest caching","author":{"@id":"https://adultinfra.com/#organization"},"publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en"},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://adultinfra.com/"},{"@type":"ListItem","position":2,"name":"Documentation","item":"https://adultinfra.com/docs/"},{"@type":"ListItem","position":3,"name":"Rules and path policy","item":"https://adultinfra.com/docs/cdn/rules-and-path-policy/"}]}]}
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://adultinfra.com/#organization","name":"AdultInfra","url":"https://adultinfra.com","logo":"https://adultinfra.com/favicon.svg","description":"Luxembourg-based specialist infrastructure for adult platforms.","slogan":"Already behind the adult internet.","areaServed":"Worldwide","knowsAbout":["Adult video CDN","Porn tube site infrastructure","Adult live-cam streaming","Creator subscription platforms","Byte-range video caching","Origin shielding","Player quality of experience","DDoS protection","GPU infrastructure","Adult-capable AI inference"],"location":{"@type":"Place","name":"Luxembourg","address":{"@type":"PostalAddress","addressCountry":"LU"}},"contactPoint":{"@type":"ContactPoint","contactType":"sales","url":"https://adultinfra.com/contact/"}},{"@type":"WebPage","@id":"https://adultinfra.com/docs/cdn/rules-and-path-policy/#webpage","url":"https://adultinfra.com/docs/cdn/rules-and-path-policy/","name":"Rules and path policy","description":"How request rules and path matching work on an adult CDN: per-workload policy for manifests, segments, and images, rule ordering, and avoiding rule sprawl.","isPartOf":{"@id":"https://adultinfra.com/#website"},"about":{"@id":"https://adultinfra.com/#organization"},"primaryImageOfPage":{"@type":"ImageObject","url":"https://adultinfra.com/og-default.png"},"inLanguage":"en","mainEntity":{"@id":"https://adultinfra.com/docs/cdn/rules-and-path-policy/#article"},"dateModified":"2026-09-13"},{"@type":"WebSite","@id":"https://adultinfra.com/#website","url":"https://adultinfra.com","name":"AdultInfra","description":"Luxembourg-based specialist infrastructure for adult platforms.","publisher":{"@id":"https://adultinfra.com/#organization"},"inLanguage":"en","potentialAction":{"@type":"ContactAction","target":"https://adultinfra.com/contact/"}}]}
```