docs: Risk Acceptances 2.0, and the risk-acceptance parts of Rules Engine 2.0

docs/content/automation/rules_engine_2/building_rules.md

@@ -98,6 +98,29 @@ ctx.rule_name
 
 A path that does not resolve produces no value rather than an error.
 
+### Conditioning on an exception
+
+With [Risk Acceptances 2.0](/triage_findings/findings_workflows/pro__risk_acceptance/) enabled,
+a rule can condition on what an acceptance is *doing*, not just on the `Risk Accepted` flag:
+
+```
+finding.has_pending_exception          somebody asked, nobody has answered
+finding.risk_acceptance_state          proposed / under_review / approved / rejected / active / expired
+finding.risk_acceptance_expiration_date
+finding.risk_acceptance_days_to_expiry negative once the date has passed
+finding.risk_acceptance_is_global
+```
+
+What that makes possible, for example: chase requests nobody has answered
+(`has_pending_exception eq true`), or warn an owner a week before an exception lapses
+(`risk_acceptance_days_to_expiry lte 7`). Because days-to-expiry goes negative rather than stopping
+at zero, "expired three days ago" is expressible too.
+
+With **Risk Acceptances 2.0** off these read empty — `false` for the boolean, nothing for the rest —
+so a rule written against them matches nothing rather than acting on a lifecycle the install does
+not use. Where a Finding is covered by more than one Risk Acceptance, they describe the earliest one
+it was accepted under.
+
 ### Available fields
 
 Each item carries a fixed set of Finding fields. This list is a contract, so it changes only deliberately.

docs/content/automation/rules_engine_2/node_reference.md

@@ -174,6 +174,24 @@ Simple risk accepts the Finding, or adds it to a risk acceptance record.
 | **How** | `simple` | `simple` sets simple risk acceptance on the Finding. `acceptance` adds it to a risk acceptance record. |
 | **Accepted** | on | Shown for `simple`. Turn off to un-accept the risk. |
 | **Risk Acceptance** | none | Shown for `acceptance`. Which risk acceptance to add these Findings to. |
+| **Accept Without Review Up To** | No limit | The most severe Finding this rule may accept on its own. Anything more severe is **not** accepted. |
+
+#### Limiting what a rule may accept on its own
+
+A rule that can accept risk can accept a Critical, and by default nothing says otherwise. *Accept
+Without Review Up To* draws that line.
+
+Findings over the limit are not dropped — the rule matched them for a reason. With
+[Risk Acceptances 2.0](/triage_findings/findings_workflows/pro__risk_acceptance/) enabled they
+are put into a Risk Acceptance **awaiting review**, named for the rule that asked and carrying why,
+so a person decides. They stay active and counted the whole time. With that feature off there is no
+review state to use, so they are simply left alone — never accepted, which is the point of the
+limit. A rule preview creates nothing, as with every other action.
+
+Two behaviours worth knowing: a severity the rule cannot recognise counts as *over* the limit (if it
+cannot be ranked it cannot be called safe), while a *limit* that cannot be recognised is ignored
+rather than blocking everything, because a rule that silently stops working is harder to notice than
+one that keeps going.
 
 ### Set Mitigation Policy