Endpoint rules & thread-safe

- policy endpoint rules
- locking for read/write repo