Which rules are not applied on a first-match basis?

[tagged]
Which rules are not applied on a first-match basis?

A.
Cleanup

B.
User Authentication

C.
Session Authentication

D.
Client Authentication