function rule::_apply_identity_rule() {
  local peer_name="${1:-}" client_ip="${2:-}"
 
  local identity_name
  identity_name=$(identity::get_name "$peer_name")
  [[ -z "$identity_name" ]] && return 0
 
  local rules
  rules=$(identity::rules "$identity_name")
  [[ -z "$rules" ]] && return 0
 
  local strict
  strict=$(identity::rule_flags "$identity_name" "strict_rule")
 
  if [[ "$strict" == "true" ]]; then
    # Strict: flush and apply only identity rules — peer rule ignored
    fw::flush_peer "$client_ip"
    while IFS= read -r rule_name; do
      [[ -z "$rule_name" ]] && continue
      rule::exists "$rule_name" && rule::apply "$rule_name" "$client_ip" || true
    done <<< "$rules"
  else
    # Additive: apply identity rules on top of peer rule
    while IFS= read -r rule_name; do
      [[ -z "$rule_name" ]] && continue
      rule::exists "$rule_name" && rule::apply "$rule_name" "$client_ip" || true
    done <<< "$rules"
  fi
}