audit: put rule existence check in canonical order