Actually that should be "rules", or at least a single rule that really has two parts. There are two primary conditions that govern my Facebook connections.
1. I must know you IRL (in real life) to send or accept a friend request.
If we're not already friends or acquaintances outside of FB, we're not Facebook friends; that's what Twitter is for.
2. I must have known you IRL for at least 6 months.
It's cool that we have mutual friends and maybe even met at a party or event, but let's not rush into anything. FB friends (like handguns) require a waiting period. If we still know each other and interact after 6 months, we can close the FB friend deal.
I've stuck to these rules for the past few years without exception. Prior to that, there were a handful (<10) of connections that would not have passed these criteria. So, I have a very few FB "friends" that I don't know in real life. All of these are either friends of friends, extended family, or connections from KYWilderness.com (the web forum that I co-admin). It has worked well for me and I plan on sticking with it.
How about you? Do you have any guidelines for who you will or will not accept as FB friends?
3. You cannot be my boss or my direct report at work.