Policies

A policy decides which rules run, their weights and parameters, the score thresholds for each risk level, and the action for each level. Scoring always uses the active version.

Thresholds and actions

Thresholds are the lowest score for each level; below medium is low.

{
  "thresholds": { "medium": 30, "high": 60, "critical": 80 },
  "actions": { "low": "approve", "medium": "approve", "high": "manual_review", "critical": "block" }
}

Actions are approve, step_up, manual_review and block.

Versions

A version’s configuration is frozen once it leaves draft or is first used to score, and this is enforced in the database. Its config_sha256 identifies it exactly, so any past decision can be reproduced.

draft → tested → active → archived

• draft: editable.
• tested: a backtest on it has completed.
• active: scores traffic. There is one active version per product, or tenant-wide.
• archived: kept for audit. Archived versions can be re-activated, which is how you roll back.

An organization with no policies gets a seeded, active “Asqary default policy”.

Lifecycle

Endpoint	Behaviour
POST /v1/policies	Creates a draft v1, or an active one with "activate": true. Everything except name is optional.
PATCH /v1/policies/{id}	Merges changes onto the latest version. An unused draft is edited in place, otherwise a new draft version is created.
POST /v1/policies/{id}/activate	Activates a version (default: latest). The replaced version is archived.
POST /v1/policies/{id}/archive	Retires the policy. The active tenant-wide policy must be replaced first.
DELETE /v1/policies/{id}	Only for policies never tested, activated or used. Otherwise archive instead.

Products

Set product on a policy to apply it only to transactions with that product. A transaction with no matching product policy falls back to the tenant-wide policy.

Change safely

The recommended order is: create or edit a draft, backtest it on your history, review the results, then activate. Activation emits a policy.activated webhook.