> For the complete documentation index, see [llms.txt](https://docs.powerdevbox.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.powerdevbox.com/power-devbox-review/flags/custom-flags/create-and-test.md).

# Create and test a flag

{% hint style="warning" %}
**Power DevBox Pro required to create, test and save custom flags.** [Buy a license](https://power-devbox.lemonsqueezy.com/checkout/buy/729d48f6-cc59-477e-a601-ca99100ffeb3), then activate it in [Settings](/power-devbox-review/settings-and-support/settings.md).
{% endhint %}

## Before you write code

Decide which **exported field** proves or suggests the problem. Download the relevant section JSON and inspect a representative sample. If the data is unavailable—such as runtime duration, a user's sharing permissions or DLP policy—the rule cannot reliably check it.

Use the narrowest suitable section. App properties belong in Apps; flow internals in Automate; agent components in Copilot; shared metadata/dependencies in Solutions.

## Create a rule

1. Load a solution, validate Pro access, and open **Custom flags**.
2. Select the relevant section, then choose **Add flag**.
3. Choose **Section**, enter a descriptive **Name**, and leave **Enabled** checked to include it in scans.
4. Paste a JavaScript **function body**, not an entire HTML/script file or JSON entry. The input is already available as `oData`.
5. Choose **Test against loaded data**.
6. Inspect the output and any error banner. Adjust the rule and retest.
7. Choose **Save flag**, then open Flag report and **Run all flags**.

![Wide desktop custom-flag editor testing a Solutions rule against a demonstration solution](https://3419344451-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYdMbKJALlFLRcjC9y72X%2Fuploads%2Fgit-blob-cf816d84435ee33bff1c16a515a2ad5c17debf41%2Freview-flag-editor-desktop.png?alt=media)

The screenshot uses a mocked test license. No real license data is included.

### AppReview example

Choose **AppReview Pro** in the Section field for an app-specific check. The example below checks `AppConfig.AppDescript` using AppReview's single pass/fail output contract. The input is one app at a time, rather than the shared Solutions object.

![AppReview custom-flag creation with the AppReview Pro section selected and a tested description rule](https://3419344451-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYdMbKJALlFLRcjC9y72X%2Fuploads%2Fgit-blob-20a91d1e3baae0a8c939e70bd2bf52e2df207163%2Freview-app-flag-create-desktop.png?alt=media)

See [Create an AppReview custom flag](/power-devbox-review/appreview-pro/quality.md#create-an-appreview-custom-flag) for the entry point from the reviewer, and [Example rules](/power-devbox-review/flags/custom-flags/examples.md) for downloadable code.

## A first Solutions rule

This checks for an empty solution inventory of environment variables. It is a team-policy example, not a universal requirement for every solution.

```javascript
if ((oData.environmentVariables || []).length) return [];
return [{
  area: oData.displayName || oData.name || 'Solution',
  component: 'Environment variables',
  type: 'ALM',
  level: 'Warning',
  reason: 'No environment variables were found. Check whether configuration is environment-specific.'
}];
```

Test against both a solution with a variable and one without. The synthetic overview example has variables, so this rule returns an empty array there. To examine the finding format, use a suitable second export or one of the [example rules](/power-devbox-review/flags/custom-flags/examples.md).

## Understand testing

**Test against loaded data** runs against every data context in the selected section and shows normalised findings. Apps are checked independently. An empty output can mean the check passed **or** that there were no contexts of that type; verify the loaded component inventory first.

Testing does not save the rule. **Save flag** saves it but does not preserve a previous report as current. **Run all flags** refreshes the report using saved, enabled rules.

Test positive and negative cases, missing/empty fields and more than one app/flow/agent. For text-based heuristics, include comments and string literals that could cause false positives. Keep rule names unique within a section to avoid unexpected replacement during import.