I work for a security company (Incapsula) and one of our product features is a PCI DDS compliant WAF. I think @symcbean already gave a great answer, so I`m just here to add a little info to the discussion:
Does order of Rules matter ?
@symcbean said it all.
How inconsistent rules are handle.
If you are referring to a scenario in which several (relevant) rules reach different conclusions, then my advise it to always go with the "harshest judgment".
This is up to you, of course. You can go the other way and implement a more lenient approach which will prevent more "false positives" but I think that, for most, security is a much bigger issue.
Also, a good rule-set will eliminate most "false positives" and inconsistencies will be few and far between.
For SAAS, you should have a lot of customization options to override default system rules, but the default setup still should be geared towards maximum security.
How redundancy is removed from the ruleset
As previously stated, there should be no redundancy in your rule-set.
Can rules be bypassed for static application layer signatures
Yes. For example, in Incapsula we use an application optimization rules which identifies commonly used applications and platforms and modifies behavior accordingly. (i.e. optimization for WP, Joomla, popular extensions and plugins and etc) I`m not advocating optimization for all possible scenarios here (simply ineffective) but if you are thinking about mass-marketing, you should at least cover the more common platforms/applications.
Best of luck