Defaults after an intrusion is found

I know Comodo has 4 default configurations.

I know I can save my configuration

Please tackle this problem

1. I started using Comodo as a Antivirus, so I choose the antivirus
2. I losened the my protected files, made it more specific and added a some regsitry values/keys to protect in my protected registry keys

SO at this stage I have an enriched AV configuration

Next I chosse to have D+ also look at drivers loads and direct disk/keyboard/screen and memory accesss.

So now program X accesses the keyboard, I get a pop-up, great, I accept, then the strange thing occurs

D+ generates a rule for program X with only My files/regsitry on ask and all others set to allow (the default of the AV config). While I had expected D+ to generate an allow for only keyboard access and the others to ASK!