Every authoritative list, in one call.

One call

The authoritative-list layer answers for every source it consulted in a single response, including the sources that returned nothing.

Complete, not partial

Issuer denylists and sanctions lists are consulted together. A source that returned no hit is still reported, with its list version and the time it answered, because "this source said no, at this version, at this moment" is a thing you will need to be able to produce later.

Fast enough to sit inline

The authoritative-list layer targets P99 under 100 ms, because it sits inside your crediting path and everything behind it waits.

Cost is visible per call

Every response reports the units the call consumed, so spend is reconstructable from your own logs rather than only from our invoice.

References, not booleans

A hit is not returned as true. It comes back with the source, the list version, the detail that source gave, and a content-addressed reference to the exact response body we received and stored. A boolean is a conclusion someone else already drew for you; a stored response is something you can re-read.

Sources stay side by side

Different sources use different scales, different category vocabularies and different update cadences. A score from one is not comparable to a score from another, and converting between them manufactures a precision that does not exist in either.

Kept as issued

Each source's verdict, score and category labels are returned in that source's own terms — untranslated, unrescaled, and attributed.

Disagreement is surfaced

When sources contradict each other the response says so explicitly, rather than picking a winner quietly and presenting the result as consensus.

No composite

There is no weighted merge and no overall figure, in any mode, including debug output.

Paid sources are gated

Consulting a paid source is the only marginal cost in the decision and the line item you will be asked to defend. The router spends as little as your risk posture allows, in a fixed order you configure and can audit.

1. 01 If the authoritative-list layer already determines the level, no paid source is consulted.
2. 02 If the amount is below a threshold you set, no paid source is consulted.
3. 03 If a valid cached result exists, it is used.
4. 04 If your budget for the period is exhausted, the decision degrades — to HOLD, never to CREDIT.
5. 05 For high-value deposits, two sources are consulted and any disagreement between them is reported.

Monthly attribution breaks spend down by rule, by source and by deposit, so the invoice can be argued with line by line rather than accepted whole.

A cache that expires on events, not only on time

Address risk is not static, and a time-to-live alone is at its least accurate on the day it matters most. Three events invalidate a cached result immediately:

1. 01 The address appears on any list.
2. 02 The address shows new on-chain activity.
3. 03 A source publishes a list update.

Time-based expiry still runs underneath all three. It is a floor, not the mechanism.