I think it's a worthwhile addition to highlight there is 3) rules which are sometimes red tape and sometimes to be broken, on top of the other 2 categories. It adds on to the original point with the addition of how to universally discover what the categories are rather than prescribe them up front.

To add to that, #3 is often explicitly encoded into the red tape as an escape hatch for foreseeable exceptional circumstances like disaster recovery and big client emergencies.