Worked example

Automated account lock & eligibility flip

A fraud model locks an account. The worked example traces the receipt, the named owner, the 2-, 24-, and 72-hour clocks, the exceptions, and the remedy.

The scenario and its three clocks

A fraud model locks an account after unusual activity. The system still issues a receipt, names who can reverse the lock, and delivers a remedy on clocks the account holder can see. Each clock is logged in the decision record.

The clocks, drawn to one scale

Each bar runs from the decision to its deadline, on one scale of hours.

Hour 0 The fraud model locks the account and a receipt is issued.

  1. Acknowledge 2 hours
    Due
    Risk Operations confirms it owns the case and tells the account holder when review will finish.
    If missed
    The case goes to the on-call fraud steward, who can reverse the lock alone.
  2. Review 24 hours
    Due
    A person keeps the lock, records an exception, or reverses it.
    If missed
    The lock lifts by default, unless a logged security exception has extended the clock.
  3. Remedy 72 hours (3 days)
    Due
    The account is unlocked, the holder is compensated, or a fallback keeps essential access open.
    If missed
    The breach is logged against Risk Operations, and credits for the locked time keep running.

A receipt issued to the account holder at the time of the lock

The receipt records that a decision happened, who owns it, and how to challenge it.

{
  "schema_version": "1.0.0",
  "receipt_id": "RCP-2026-0441",
  "issued_at": "2026-02-14T14:03:22Z",
  "owner": {
    "name": "Risk Operations",
    "role": "System owner",
    "contact": "risk-ops@company.example",
    "on_call": true
  },
  "subject": {
    "id": "usr-103991",
    "type": "account"
  },
  "action": {
    "class": "WRITE",
    "description": "Lock account access for review",
    "reversible": true,
    "tools": ["fraud_model", "account_admin_api"]
  },
  "decision": {
    "decision_type": "account_lock",
    "reason_codes": ["FRAUD-THRESHOLD", "VELOCITY-SPIKE"],
    "inputs": ["score:0.93", "velocity:4.2x"]
  },
  "clocks": {
    "ack": {
      "hours": 2
    },
    "review": {
      "hours": 24
    },
    "remedy": {
      "hours": 72
    }
  },
  "appeal_path": {
    "url": "/appeals/account-lock",
    "channel": "in-app form",
    "expected_response": "Human review within 24 hours"
  },
  "evidence_pack": {
    "href": "/evidence-packs/std-02#std-02-2-1",
    "standard_refs": ["STD-01.1.1", "STD-02.2.1"]
  }
}

The receipt includes the clause references (STD-01.1.1, STD-02.2.1), the appeal path, and a link to the evidence pack used in review. Match your payload to the canonical receipt schema.

Named owner and escalation authority

The lock has a named owner, and the ownership carries a deadline.

  • Owner: Risk Operations, which must acknowledge the case.
  • Authority: The on-call fraud steward, who can reverse the lock without a manager's approval.
  • Escalation: The Security and Legal Review Board, if the case meets the criteria for an irreversible action or a legal hold.

Exception handling

Bounded exceptions for security or legal holds

Exceptions never erase the receipt or clocks. They only delay specific actions.

  • Security exception: The lock can stay in place. The acknowledgment and review clocks still run, and can be extended by at most 72 hours.
  • Legal hold: The remedy can be delayed. The account holder must still be able to read statements and see pending withdrawals.
  • Escalation: Each exception is logged in the Exceptions register with the date a steward will next review it.

Remedy path

Remedy is visible, reversible, and time-bound

The remedy path gives the challenge somewhere to land, and limits the harm the lock does while it stands.

  • Primary remedy: If no fraud is confirmed, the account is unlocked and eligibility restored within the remedy clock.
  • Alternative remedy: If the lock must stand, the holder gets limited access and a place in a manual review queue.
  • Compensation: Credits for the time the account was locked, recorded against the decision log entry.
  • Repeated reversals: Each lock reversed on review is counted against the rule that triggered it, here FRAUD-THRESHOLD or VELOCITY-SPIKE. The count goes to Risk Operations, which owns the rule. When the count passes a set number, Risk Operations reviews the threshold and records what changed.

Generated artifacts

Decision log, evidence packs, and appeal record

These records show that the decision followed the policy. The policy alone cannot show that.

Decision log entry

The MEC-01 record of the model's output, any reviewer's dissent, and the outcome of review.

Open artifact →

Evidence pack list

The evidence for the STD-01 and STD-02 clauses on challenges and remedy.

Open artifact →

Appeal intake record

The MEC-06 record of the challenge, with the decision's context and trace filled in.

Open artifact →

Exception log

An exception entry with an end date, if the lock is tied to a security or legal hold.

Open artifact →

Where this fits

Credit, payments, and account holds

Whether a person gets credit, at what limit, and whether they can use the money or the account they already have.

Scored cases
Standards to adopt
Run first
Delegation audit. Take one hold or limit workflow through six questions. See which actions nobody can justify, and whether each can be undone.

Terms used: Time transparency Stable clock Bounded duration Decision artifact Traceable ownership Safe pause Time to restore (TTR) Time to halt (TTH) Appeal passage rate

The full entry, and where the framework does less →