Thoughts...per user and how does one add rules without using learning mode?

[polobo]

It seems like having per-user permissions would be needed to make this usable in production

How (can) does one add rules to a system without putting it into learning mode and thus expose the database during changes?

A use case seems to be training during testing/staging and then moving that training data to the production system. Is this possible?

[snaga]

It seems like having per-user permissions would be needed to make this usable in production

Yes, every rule is already "per-user" permission.
The sql_firewall.sql_firewall_statements view has "user_id" column, and the user_id is associated with each user.

How (can) does one add rules to a system without putting it into learning mode and thus expose the database during changes?

Try sql_firewall_import_rule() function to import the rules from a CSV file.

A use case seems to be training during testing/staging and then moving that training data to the production system. Is this possible?

Yes, it is one of the use cases we expect to see, because writing every rules by hands is way too difficult in the real world.