The reason to have them is that application checks only protect the paths you remembered to check. Rules sit underneath every path at once, including the one added next month by someone who did not read your middleware. They are the layer that holds when the layers above are bypassed.
Write them as denials first. Start from deny everything, then open the narrowest thing that works. A rule set that starts permissive and gets tightened is one forgotten path away from being open, and you will not find out from your logs.
Updated August 2026