A rule is a claim. Write it like one.

Fictional scenarios and synthetic data. Reviewed 6 November 2026.

Tomas opens the rule editor at Northbank Pay and finds a rule called R-117 hi risk combo v3. It has been live for fourteen months. Nobody on the team wrote it. It declines around sixty transactions a day. Ines asks the question that starts this article: what is it for?

What is actually being decided.

A fraud rule is a claim about the world dressed up as a line of logic. The claim is: when this entity shows this measure over this window above this threshold, something is wrong often enough that interrupting it is worth the cost. Every part of that sentence is a decision someone made, and every part can be wrong.

Three parties carry the consequences. The merchant carries the customers the rule interrupts and the fraud it misses. The PSP carries the explanation when an acquirer such as Stilling Bank asks why a ratio moved. The analyst carries the rule itself, which means carrying its maintenance, its silence and its eventual retirement. A rule nobody can explain cannot be owned, and a rule nobody owns cannot be tuned.

The four parts of a rule sentence.

The rules that age well can be read aloud as one sentence with four parts: an entity (the thing being counted: a card, an account, a device reference, an IP range, a merchant), a measure (what is counted: attempts, distinct cards, declined authorisations, refund value), a window (over what period) and a threshold (the number that turns an observation into a trigger). The action is a fifth part, and we come to it below.

Write the rule like this:

IF <entity> <measure> over <window> exceeds <threshold> THEN <scoped action> with <owner, review time, rollback>.

Filled in, for a synthetic Pondside Gifts rule:

IF a device reference records more than 8 distinct card numbers in authorisation attempts over 10 minutes THEN route further attempts from that device reference to step-up for 2 hours. Owner: Tomas. Review: 09:00 next working day. Rollback: remove the device reference from the step-up list.

Compare that with R-117 hi risk combo v3. One of these can be tested, challenged and switched off. The other can only be feared.

The alternative we keep alive: a rule written in a sentence can still be wrong. The sentence makes the claim visible; it does not make the claim true.

The action is scoped, owned, reviewable and reversible.

The threshold decides whether to act. The action decides how much. most of the damage a rule does is in an action that is wider than its evidence.

A device reference with eight cards in ten minutes is an observation. "This is a card-testing script" is an inference, and OWASP's catalogue of automated threats (OAT-001, carding) describes the pattern at the level a defender needs. The inference may be right. It may also be a family sharing a tablet at a kitchen table during a sale. The action should fit the uncertainty: step-up, a short cooling period, a review queue. Not a permanent block on the device, the IP range and the merchant's whole category.

Four properties make an action defensible. Scoped: it touches the entity that produced the evidence and nothing wider. Owned: a named person will look at what it did. Reviewable: there is a time at which someone checks whether it is still earning its keep. Reversible: there is a known way to undo it, and the rollback is written down before the rule goes live, not after it misfires.

A rule has a purpose and a budget.

Every rule should carry two numbers beside it: what it is meant to catch, and what it is allowed to interrupt. These are the rule's purpose and its budget.

In this illustration, a rule flags 400 transactions in a month. Later outcomes show 120 of them were fraud and 280 were legitimate customers. Using the definitions in Google's machine-learning crash course, precision is true positives over everything flagged: 120 / 400 = 0.30. The rule's budget was written as "no more than three legitimate interruptions per fraud caught". It is spending 280 / 120 = 2.33 interruptions per catch, so it is inside budget. Had the outcome been 60 fraud and 340 legitimate, precision would be 60 / 400 = 0.15, the ratio 340 / 60 = 5.67, and the rule would be over budget and due for tuning or retirement.

Recall (fraud caught over all fraud) needs a denominator the rule cannot see on its own: the fraud that got through. Dispute and fraud reports arrive late, so this number is always provisional. A chargeback arrives in its own time covers how to wait for it honestly. The Volume 01 lesson Measuring errors is the foundation for both numbers.

The alternative explanation we keep alive: a rule with excellent precision may simply be catching fraud that two other rules would also have caught. Measure what it catches alone before you decide it is valuable.

Silence is a finding.

A rule that fired sixty times a day and now fires zero times is telling you something. Either the pattern it watched for has gone, or the data feeding it has changed shape. the second is far more common. An export renames a field, a merchant changes its integration, a device-reference library updates its format, and the rule carries on evaluating to false forever, without an error.

Treat each rule's firing count as a time series and compare it with its own baseline by weekday. Compared with what, exactly describes the baseline. A drop to zero for a previously active rule warrants checking traffic, eligibility and telemetry before concluding that either an incident or a genuine improvement occurred. The Volume 02 case silent-rule is built on exactly this.

A note for the acquirer and the auditor.

When Stilling Bank asks why a merchant's ratio moved, or when an auditor asks what controls were in place in March, the answer is a list of rule sentences with their purposes, budgets, owners and change dates. "We have a sophisticated engine" is not an answer anyone can check. A rule that can be read as a claim can be defended as a control. One that cannot be read cannot be defended, however well it performs.

A failure mode to watch.

The rule is tuned by adding conditions. Each false positive someone complains about becomes a new exception: not this BIN, not this country, not after 18:00. After a year the rule has eleven clauses, no one knows which clause does the work, and removing any of them feels dangerous. A rule that needs eleven clauses is usually three rules with three purposes, and should be split so each can be measured on its own.

A way to work it.

1. Take one live rule you did not write. Rewrite it as the four-part sentence. If you cannot, that is the first finding.
2. Write its purpose (what it catches) and its budget (interruptions per catch it is allowed) in one line each.
3. Pull the last 90 days of what it flagged and join to outcomes. Compute precision and the interruption ratio. Compare with the budget.
4. Write the action in the scoped, owned, reviewable, reversible form. If the live action is wider, narrow it and set a review date.
5. Add the rule's daily firing count to a chart with a weekday baseline. Set a note to look at it if it goes quiet.
6. Record all of this in the rule's description field, where the next person will find it. Write the note for the person who reopens it applies to rules as much as cases.

Take it to the desk.

Which of our live rules could each of us explain, from memory, in one sentence that names the entity, the measure, the window and the action?

Try it: A high-value rule stopped firing three weeks ago Look up: precision · false positive · velocity

Before this piece, the Volume 01 lesson Evidence before action says why the observation comes first. After it, The threshold is a price, not a score prices the fourth part of the sentence.

Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.

Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.