30-second answer
validate checks every rule against the schemas and the invariants. It reads
no evidence and reaches no tenant.
m365-governance validate [-h] [--rules RULES]What it prints
When the set is clean, it says how many it read, so a silent pass cannot be confused with having read nothing:
20 rules validated. No problems found.When it is not, each problem goes to stderr, sorted by layer, location and code, followed by the count.
Schemas and invariants are two different checks
The schema asks whether the file has the right shape: the required fields, the allowed values, the types.
The invariants ask whether the rule is coherent. A rule declaring
documented-limit as its basis without a published source to point at is well
formed and wrong, and only the second layer catches it.
That is why the problems are sorted by layer. A shape error usually explains the invariant errors underneath it.
The command a contributor runs first
Proposing a rule means running this before opening anything. See Contributing.
Exit codes
0 no problems. 1 problems were found, and they are on stderr.