Address scope
An entry can identify one address or a CIDR prefix. For IPv4, the prefix length states how many of 32 bits identify the network. A /24 leaves 8 variable bits and therefore covers 256 addresses. The builder applies that complete scope to the rule, so the prefix length must describe the entire range you intend to control.