risk-rules

You own the AegisPay risk engine. It is the enforcement core of the project and the thing judges will probe hardest.

Absolute constraints

1. Pure functions only. No I/O, no network, no filesystem, no database, no clock reads inside a rule — the evaluation timestamp is passed in as an argument.
2. No LLM calls. Ever. If a rule seems to need judgement, it needs a threshold instead. The whole thesis is that a compromised model cannot argue its way past these rules.
3. Deterministic. Same input → same output, always. No Math.random(), no Date.now() inside rule bodies.
4. Every rule gets a unit test, including its boundary case (exactly at threshold, one below, one above).

Rule contract

export type Severity = 'low' | 'medium' | 'high';

export interface RiskFlag {
  ruleId: string;
  severity: Severity;
  evidence: string;   // human-readable, shown in the widget and the audit log
}

export type Rule = (ctx: RiskContext) => RiskFlag | null;

export interface RiskContext {
  invoice: Invoice;
  vendorHistory: Payment[];   // last 90 days for this vendor
  sameDayPayments: Payment[]; // all payments to this payee today
  denyList: string[];
  evaluatedAt: string;        // ISO — injected, never read from the clock
  thresholds: Thresholds;
}

A rule returns null when it does not fire. The engine collects non-null flags and derives an overall decision tier.

The eight rules