Start here

How Blnk Watch Works

See how transactions enter Watch, how rules are evaluated, and how a final risk verdict is produced.

Every transaction in your system carries signals that indicate risk. A payment might exceed a limit, a payout might violate a policy, or a pattern of activity might suggest abuse.

Blnk Watch evaluates those signals using rules you define and returns a risk verdict for each transaction. It runs alongside your Blnk Ledger and allows you to apply checks before, during, or after a transaction is processed. When a transaction occurs, Watch evaluates it against your rules and produces a verdict such as allow, approve, alert, review, deny, or block.

With Watch, it becomes easier to enforce controls within your application such as:

1. Detecting and acting on transactions that show patterns of fraud or compliance risk
2. Enforcing transaction limits by blocking, reviewing, or tracking threshold breaches
3. Monitoring transaction velocity to spot spikes or unusual activity patterns
4. Reviewing or tracking payouts and withdrawals based on defined conditions
5. Tracking how discount codes or promotions are used to detect abuse or measure usage
6. Enforcing operational guardrails like identifying duplicates, missing fields, or unexpected flows

Evaluation workflow

Once a transaction enters Watch, it follows the same lifecycle every time:

1. It checks the transaction against the active rules.
2. Multiple rules can trigger for the same transaction.
3. Each triggered rule contributes a score and a reason.
4. Watch consolidates all triggered rules into a single final decision.

The result is a consolidated risk assessment that your system can use to determine what should happen next.

Rule evaluation

Rules define the decision logic used by Watch. They determine how transactions are evaluated and ultimately classified.

You define and manage these rules using watch scripts .ws, our DSL. Every rule contains two main parts:

1. A when condition that describes the pattern Watch should look for in a transaction.
2. A then action that defines the outcome when the condition triggers, including the verdict, score, and reason.

rule RuleName {

  when condition

  then verdict
       score   value
       reason  "explanation"
}

During evaluation, Watch runs every transaction through the active rule set and updates the transaction result with only the rules that trigger.

The evaluation process follows a few simple principles:

1. If a rule does not trigger for the transaction, it contributes nothing to the evaluation.
2. If a rule triggers, it produces a risk signal consisting of a verdict, score, and reason.
3. Multiple rules can trigger for the same transaction during a single evaluation cycle.
4. All triggered signals are preserved and later consolidated into the final decision.

Because of this evaluation model, rule design works best when rules are small and focused. We recommend creating each rule to capture a single risk pattern or control.

Final verdict

After collecting all rule outcomes, Watch produces one consolidated result for the transaction. This consolidation step turns many rule-level outcomes into one application-ready decision:

1. final_risk_score summarizes the combined risk signals.
2. final_verdict represents the action state your system should use.
3. final_reason explains the main context behind that decision.

Your app can then act in a deterministic way:

1. Continue normal processing for allow.
2. Explicitly accept trusted transactions for approve.
3. Notify or log mild anomalies for alert.
4. Route the transaction for additional checks for review.
5. Reject policy-violating transactions for deny.
6. Stop or reject the transaction for block.