​
Rules in Verisoul

Rules enable real-time, automated decision-making by defining conditions that trigger list actions. They form the dynamic component of your fraud prevention strategy, allowing you to automatically respond to fraud patterns as they emerge.

​
Understanding Rules

Rules consist of three main components that work together to automate fraud prevention decisions:

​
1. Triggers

Triggers define when a rule should be evaluated:
Trigger TypeDescriptionUse Case
First Session for AccountEvaluates only on the first session associated with an accountAccount creation, initial signup screening
All SessionsEvaluates on every session for an accountOngoing monitoring, behavioral changes

​
2. Conditions

Conditions define the filtering logic that determines when a rule should fire. Available Fields: You can use any field available in the Authenticate API response to create complex conditional logic. All fields on the account and session table in the dashboard are available to use in rules. Example fields include:
  • Account Data: decision, account_score, bot, multiple_accounts
  • Session Data: session.location.country_code, session.network.service_provider, session.proxy
  • Email Intelligence: email.disposable, email.domain_type, email.email_score
  • Network Signals: risk_signal_scores.proxy, risk_signal_scores.vpn, etc.
Logical Operators:
  • AND: Fields from both account and session can be used
  • OR: Currently OR cannot be nested inside an AND condition
  • Numeric Operations: Scores are normalized to 0-100%
  • String Operations: All string operations are case-insensitive
  • List Operations: is in, is not in Can also be used on string fields

​
3. Actions

Actions define what happens when a rule’s conditions are met:
Action TypeDescriptionEffect
Add to ListAdds the account to a specified listMoves account according to list hierarchy
Remove from ListRemoves the account from a specified listRemoves account from specified list only

​
Rule Management and Versioning

​
Rule Versioning

  • Immutable History: Every rule update creates a new version
  • Audit Trail: Complete history of rule changes is maintained
  • No Deletion: Rules can be archived but never permanently deleted
  • Ledger System: Once a rule triggers for an account/session, it remains in the history forever

​
Rule States

StateDescriptionBehavior
EnabledRule is active and evaluatingProcesses all matching triggers
DisabledRule is inactiveNo evaluation occurs, but history is preserved
ArchivedRule is retiredNo longer visible in active rules, but history remains

​
Rule Execution

Processing Characteristics:
  • Parallel Execution: Multiple rules can trigger simultaneously on the same API request
  • Real-time Processing: Rules are evaluated synchronously with API requests
  • Order Independence: Rules execute in parallel, not sequentially
  • Conflict Resolution: When multiple rules affect the same account, all actions are processed together

​
List Movement Logic

​
Standard List Hierarchy

Rules respect the standard list hierarchy when adding accounts to lists: 
Allow List (highest priority)
    ↑
Main Account List  
    ↑
Block List (lowest priority)
Movement Rules:
  • Block → Main Account: ✅ Allowed
  • Block → Allow: ✅ Allowed
  • Main Account → Allow: ✅ Allowed
  • Allow → Block: ❌ Not allowed via “add to list”
  • Allow → Main Account: ❌ Not allowed via “add to list”

​
Simultaneous Add/Remove Operations

When both add and remove actions occur in the same API request:
  1. All remove actions are processed first
  2. All add actions are processed second
  3. Final list membership reflects the net result
Example Scenario:
  • Account is on Allow List
  • Rule A: Remove from Allow List
  • Rule B: Add to Block List
  • Result: Account ends up on Block List

​
Common Use Cases

​
Email-Based Rules

  • Block disposable email providers
  • Allow trusted corporate domains
  • Allow test accounts in development environments

​
Geographic Rules

  • Block high-risk countries
  • Allow specific regions
  • Handle VPN/proxy detection

​
ISP and Network Rules

  • Block risky internet service providers
  • Allow certain corporate vpn IP’s