The current way of thinking in audit is one of rules that are violated. That 
is too specific.
As an example, classes should either become final or 
have certain restrictions to be inheritable. If I just want a report which 
classes are inheritable and which ones are final, the audit module should 
be able to provide that. In that context, a rule "violation" makes no 
sense.

Also, certain rules may report more than once. With a 
"violation" of e. g. "don't import packages", only the first one would be 
reported. However, perhaps you'd like to see *all* places where this 
takes place.

So a rule should be split into a Condition and an Action 
part (perhaps I can find a better name to avoid the conceptual name clash 
with swing/openapi Actions), and a client can choose whether to look only 
for the first match of a condition or all of them.