In rule-based systems, which takes precedence: a deny rule or a allow rule?

Answer: The allow rule has the highest priority among all rules.

If a request matches a allow rule, it will bypass all other security checks—even if it is flagged as malicious by the WAF—and proceed directly to your server.
Therefore, when configuring allow rules, we strongly recommend:
​Use allow rule with extreme caution.
Enable the ​"Continue to detect and log attack requests even when whitelisting." option.
This ensures that if attackers exploit your allow rule to infiltrate your website, you can immediately review attack details in ​Attack > Logs and take remedial action.