The plugin was born of the needs to limit the REST api to certain users
The normal operation of the plugin is that all interactions from Atlassian products are not intercepted and the rules are not applied.
Only when direct REST api requests are done, those calls get a validation against the custom defined rules and are determine if a request is allowed or blocked with a HTTP 403 Status code.
Be aware that a huge number of rules can impact the performance of the REST api calls!