[is_taken]

Would be interesting to see the performance difference if you undo that move-&-change and change the function signature from:

  func (r Ruleset) Match(path string) (*Rule, error)

to:

  func (r *Ruleset) Match(path string) (*Rule, error)

[masklinn]

Likely none: Ruleset is

    type Ruleset []Rule

The original code creates a local copy of a rule and explicitly returns a pointer to that. Taking the ruleset by address wouldn't change that issue.