Product · Gate
One call before you credit.
A deposit lands. Before it becomes a balance somebody can withdraw, your integration asks one question and gets one of three answers, with the reason class, the pool the funds belong in, what would clear a hold, and a reference to everything the answer rested on. The interesting part of this page is not the happy path. It is the table of what happens when something breaks.
Three answers
There is no fourth, and there is no numeric field you could threshold yourself into a fourth.
- CREDIT
- Nothing was found, everything that should have been checked was checked, and coverage health for this decision was clean. Credit it.
- HOLD
- Do not credit yet. Either something was found that needs a person, or something could not be checked. The response says which of the two it is, what would clear it, and by when.
- REJECT
- Do not credit. The response carries the reason class and the pool the funds should be routed to instead of your general collection address.
CREDIT is the only verdict that requires everything to have gone right. That asymmetry is the design, not a side effect of it.
What the response carries
- Decision id
- Stable for the life of the record, and the key to the evidence bundle years later.
- Verdict and risk level
- The answer, and the class it falls into. A class, not a score — see the constraint at the foot of this page.
- Pool
- Which collection pool this deposit belongs in. Sweeping checks the pool before it moves anything.
- Reasons
- Classification codes. You learn why it was held; you do not learn how the conclusion was reached. Any reason that came from an external source carries a reference to that source’s stored raw response.
- Source disagreement
- A flag, set when the sources consulted contradict each other. It is surfaced to you rather than resolved on your behalf.
- Rule version
- The exact configuration that produced this verdict, so an old decision can be re-read under the rules that actually applied at the time rather than under today’s.
- Required actions and deadline
- What has to happen for a HOLD to clear, and the point at which it breaches your own service target.
- Evidence reference
- Content-addressed, resolving to the bundle described under Evidence.
What happens when something breaks
This table is the product. Every path below resolves to HOLD. There is no combination of failures that produces CREDIT, no flag that relaxes it, and no availability target that outranks it.
| Failure mode | Result | How it reaches you |
|---|---|---|
| A screening source times out or is unavailable | HOLD | 200 · SCREENING_DEGRADED |
| Your screening budget for the period is exhausted | HOLD | 200 · BUDGET_EXHAUSTED |
| A list is older than its freshness target | HOLD | 200 · LIST_STALE |
| The decision cannot be reached inside its latency budget | HOLD | 200 · timeout degrades |
| An authority relevant to this deposit is not currently observable | HOLD | 200 · coverage_health |
| Foreshock is unavailable, or your network cannot reach it | HOLD | 5xx or no response · SDK converts it |
| Anything not in this table | HOLD | — |
The default lives in the SDK
When we are unreachable there is no response for your code to interpret, so the safe behaviour has to be somebody’s default. We make it ours. The client SDK treats a 5xx, a timeout and a connection failure as HOLD out of the box, with nothing to configure. Defaults decide how the overwhelming majority of integrations actually behave, and leaving this particular one to the integrator is exactly how a fail-closed system quietly becomes a fail-open one.
Rules are configuration
Changing a threshold is not a deploy, and it is not invisible either.
- Versioned
- Every change takes a version, and every decision records the version it ran under.
- Two-person review
- A rule change needs a second person before it takes effect. This is enforced by the console, not by a handbook.
- Shadow mode
- Run a proposed rule set against live traffic without it affecting any verdict, and read the difference before you commit to it.
- Auditable
- Who changed what, when, and what the previous value was — in the same append-only record as the decisions themselves.
Funds do not get mixed
A verdict carries the pool the deposit belongs in, sweeping checks the pool before it moves anything, and a periodic self-check re-reads the assignment of everything already swept. The failure this prevents — quarantined funds landing in the same collection address as clean funds — cannot be undone after the fact, so it is checked before the sweep and again afterwards.