Trace_Inspector / policy-rejected

Policy blocks an unapproved payment

REJECTED

HTTP 403

Seeded Trace Sequence

policy-rejected

OWNERSHIP_CHECKSUCCESS

Invoice is owned by the tenant

The gateway resolves the owned invoice before evaluating spend rules.

POLICY_EVALUATIONERROR

Active policy rejects recipient

The recipient is missing from the approved-address allowlist.

AUDITSUCCESS

Blocked outcome recorded

The rejection is written as a blocked payment request with the policy snapshot.

RESULT_PAYLOAD

{
  "status": "REJECTED",
  "reason": "Recipient address fibt1q_unapproved... is not on the approved allowlist"
}

Technical Summary

Tenant Context

sandbox-merchant

Auth Scopes

payments:write

Demonstrates

- Policy failures return a concrete rejection instead of vague risk scoring.

- The blocked request still produces an audit trail.

- Execution does not reach Fiber when the policy layer rejects the request.

REQUEST_BODY

POST /api/v1/payments

{
  "invoice": "fibt1q_unapproved..."
}

RESPONSE_BODY

Status 403

{
  "status": "REJECTED",
  "reason": "Recipient address fibt1q_unapproved... is not on the approved allowlist"
}

Submission Boundary Note

Seeded scenario based on the current policy service and payment handler rejection branch.