§ 1
In brief
A payment
Meets the rules
of its unit and of every unit above
Never
What must never happen
a second charge for one request, a payment without an order
Policies
What a unit may do
set above, tightened below, enforced where needed
Risk rules
What to do with this payment
block, hold, route elsewhere or notify
Recorded
The decision and the rule versions
- Never-rules first
- A second charge for the same request and a payment without an order are refused in every case.
- Floors down the structure
- A policy set above applies below. An enforced policy cannot be changed by any unit under it.
- Risk rules of a unit
- Conditions on amount, instrument, country and frequency, with an action: block, hold for review, route or notify.
- Versions
- A changed rule is added as a new version with the date and the role that set it; the old one stays in the record.
§ 2
In detail
2.1
What must never happen
The first rules say what must never happen: a second charge for the same request, a payment without an order, a decision about a fact recorded before the fact existed. Then come the scenarios that must work, each with its expected result: how many charges, which amount, which final state. Everything else is left open.
Prohibitions alone are met by a system that does nothing, so the set of scenarios that must work is never empty.
2.2
Policies with floors
Every unit inherits the policies set above it and may override, narrow, enforce or block them, within floors nobody below can lower. A routing strategy set at the group applies to every store and channel; a terminal bank set at a region applies to its stores; a capture mode set on the online channel applies to its orders. The effective policy of a unit says where each value came from.
Demo scene 1
A limit and a list, resolved for the website
From the default down to the website: the limit per payment, which may only be lowered, and the blocked countries, which may only be added to.
yarmarok.example · Maximum for one payment = ₴200,000.00
- default: no limit
- →Yarmarok Retail Group ₴200,000.00 applied
yarmarok.example · Blocked countries = RU, BY, KP, IR, SYYarmarok Retail Group
- default: none
- →Yarmarok Retail Group RU, BY, KP, IR, SY applied
2.3
Risk rules of a unit
A risk rule is a short sentence: conditions on amount, currency, instrument, countries, score and frequency, joined by and or or, with an action — block, hold for review, route elsewhere or notify. Rules accumulate down the structure by priority. Routing rules are of the same kind: a strategy, a threshold, and exceptions that send a kind of card to a kind of bank.
Demo scene 2
Risk rules in force
Rules of the demo group’s units: the conditions, the action and the unit that set each rule. A lock marks a rule that the units below cannot switch off.
| Rule | Conditions | Action | Unit |
|---|---|---|---|
| Five attempts in a day by one payer are reviewed | Attempts in 24 h ≥ 5 | hold for review | Yarmarok Online |
| Online baskets above UAH 40,000 with elevated risk are reviewed | Amount ≥ ₴40,000.00 · Risk score ≥ 35 | hold for review | Yarmarok Online |
| Foreign cards above UAH 10,000 are reviewed | Issuer’s country ≠ UA · Amount ≥ ₴10,000.00 | hold for review | Yarmarok Online |
2.4
A changed rule is a new version
Nothing that decided a payment is edited afterwards. A changed policy is a new setting with its date and the role that set it; a changed routing function is a new version beside the old one. The fact that records a decision — a route, a score, a fee — names the version that made it, so any payment can be explained with the rules of its own day.
§ 3