For each risk firewall instance you create, you must register at least one rule class. For each default rule class that you register, you must also add at least one rule class instance. For each custom rule class that you register, you might or might not need to add at least one rule class instance. This depends on how you implemented your custom rule class. See
Implementing custom risk firewall rule classes.
For the risk firewall to approve an order, the order must comply with (it must match) at least one instance of each registered rule class. If your custom rule class does not require the addition of a rule class instance, then an order must match the rule class for the risk firewall to approve the order.