Suricata

A pass rule may be applied to a packet only (cf https://docs.suricata.io/en/latest/rules/intro.html#action)
or to the entire flow in case of a TCP connection (cf https://docs.suricata.io/en/latest/configuration/suricata-yaml.html#action-order),
and there may be other special, undocumented cases.

List all known scopes, and document them, preferably in the Rules introduction document.