What is the order that rules are applied to a policy?
15.X, 16.X
Exceptions are always processed first to ensure no waste of resources scanning a excluded item. From there, top level rules (those that are used together with the OR operator) are always applied.
Compound rules (those that are used together with the AND operator) are short circuited when any sub-rule fails to match.
Note: As a rule, least expensive rules are applied first