Decisions, evidence and reason codes
A successful Decision API response contains trace_id, event, decision, risk_score, reason_codes, evidence, providers_used, evaluated_at and audit_retention_note. Policy outcomes are allow, review and decline. HTTP failures are handled separately and do not contain a successful policy decision.
Starter policy thresholds
The implemented starter policy returns decline at scores of 80 or above, review from 40 to 79, and allow below 40. Missing identifiers add 70, country mismatch adds 45, invalid phone lookup adds 65, and a VoIP classification adds 45. A payout with a nonzero score adds another 10, capped at 100. These are development rules, not validated fraud-probability estimates.
Evidence and reasons
Each evidence entry has provider, signal, value, confidence, observed_at and metadata. Adapter confidence is a declared evidence field, not a proven model-accuracy metric. Reasons currently include identifier_missing, country_context_mismatch, phone_lookup_invalid, phone_line_type_voip and no_local_policy_exception. Do not infer identity validation from the last reason.
Trace scope
Development traces record identifier types rather than raw identifier values and are bounded in memory. Default production trace retrieval is disabled. Controlled-pilot mode has a separate account-scoped encrypted audit store and retention setting. A public trace ID alone grants no access, and the response does not contain a policy_version field.
Sources and scope
Based on the alpha contract and source implementation. Live route availability requires separate confirmation.