Tags and rules
One rule is one sentence: Macs tagged X can reach Y on Z. If it can’t be said in one line it should be two rules. Tags, not machines, on both sides.
Saving
Saving recompiles and pushes the whole rule set; it takes effect on every Mac within seconds. Deleting a tag deletes the rules that use it.
If you lock yourself out
Your Macs talk to Rig over the internet, not over the mesh. A rule that cuts every mesh connection does not cut that channel. Dangerous changes wait ten minutes for a Mac to confirm the mesh still works; otherwise they revert.