30-second answer
show-rule prints one rule in full, including, as the help text says, what it
does not establish.
m365-governance show-rule [-h] [--rules RULES] IDWhy "what it does not establish" is part of the rule
A rule that only stated its check would invite the reader to infer more than it
found. SPO-SPFX-001 finds that a solution is installed at an older version
than the catalog holds; it does not establish that the newer version is safe to
deploy, or that anybody is affected. Writing the boundary into the rule is what
stops the inference happening silently in a meeting.
This is the same commitment as what a read only gate proves, applied one rule at a time.
Options
--rules behaves as everywhere else: omit for the packaged rules, supply a
directory to replace them entirely.
Exit codes
0 printed. 2 there is no rule with that identifier in the set being read.
The message names the identifier rather than raising.