When evaluated, the rule must return a string that represents a single account ID or to a list in which the elements are account IDs.