30-second answer
list-rules prints every rule with the kind of claim it makes.
PowerShell
m365-governance list-rules [-h] [--rules RULES]What it prints
Text
ID VERSION BASIS SEVERITY APPLIES TO TITLE
---------------------------------------------------------------------------
SPO-LIST-002 v1.0 documented-limit high list A list or library may not hold more than 50,000 unique permission scopes
SPO-LIST-001 v2.0 documented-limit medium list A list or library past 100,000 items can no longer have its permission inheritance broken
SPO-SHARE-002 v1.0 documented-guidance medium site The default sharing link should not be Anyone
SPO-SHARE-003 v1.0 documented-guidance medium tenant The organisation default sharing link should not be AnyoneBASIS is the column that matters. It says what kind of authority the rule
has. documented-limit is a limit the vendor publishes, and exceeding it
breaks. documented-guidance is the vendor's recommendation, and departing
from it is a decision rather than a defect. Presenting the two as one list of
problems is how a governance report loses the argument it was meant to win.
SEVERITY is not urgency. See outcome, severity and attention.
Options
--rules is a directory of rule files. Omit it to list the rules that
shipped with this version. Supplying one replaces them entirely rather than
adding to them, so the output is the full set that would run, never a merge.
Exit codes
0.