Rules live in the database.
If a control matters, the database enforces it: approval limits, the three-way match, site access and the audit trail. Nobody can click, script or export around it.
In practice
Not even an administrator can delete an audit entry.