Worked example

Irreversible payment with compensation

A payout that cannot be reversed. The receipt is issued before release and commits to 1-, 8-, and 48-hour clocks and to compensation if the payout was wrong.

Receipt issued before release

An action that cannot be undone issues its receipt before it runs.

{
  "schema_version": "1.0.0",
  "receipt_id": "RCP-2026-1362",
  "issued_at": "2026-06-19T16:21:33Z",
  "owner": { "name": "Payments Risk", "role": "System owner" },
  "subject": { "id": "txn-22098", "type": "payment" },
  "action": { "class": "TRANSFER", "description": "Release irreversible payout", "reversible": false },
  "decision": { "decision_type": "payout_release", "reason_codes": ["RISK-LOW"] },
  "clocks": { "ack": { "hours": 1 }, "review": { "hours": 8 }, "remedy": { "hours": 48 } },
  "appeal_path": { "url": "/appeals/payout", "channel": "in-app form" }
}

Clocks

Short review windows, and exceptions that leave them running

The deadlines are short because the payout cannot be undone.

The clocks, drawn to one scale

Each bar runs from the decision to its deadline, on one scale of hours.

Hour 0 The receipt is issued and the payout is released.

  1. Acknowledge 1 hour
    Due
    Payments Risk acknowledges the payout and names the reviewer.
    If missed
    The case goes to the steward on call.
  2. Review 8 hours
    Due
    A person checks the payout for fraud, sanctions, or errors.
    If missed
    Further payouts cleared by the same rule wait for a person until the review is done.
  3. Remedy 48 hours (2 days)
    Due
    Compensation is paid, or a dispute starts to recover the money.
    If missed
    Compensation is paid by default, without waiting on the dispute.
  • An AML or legal hold can pause the payout. It leaves the receipt and the clocks in place.
  • A security escalation needs a steward's sign-off and leaves an audit record.
  • Each exception is logged at once in the Exceptions framework.

Remedy

Compensation is the default fallback

A payout that cannot be undone must have a compensation path.

  • Credits or chargebacks are issued within the remedy clock.
  • A person can ask for a human review, which starts within 24 hours.
  • Everyone affected is told, with a link to the evidence pack.
  • Each payout later found wrong is counted against the rule that cleared it, here RISK-LOW. The count goes to Payments Risk, which owns the rule. When the count passes a set number, it reviews the rule and records what changed.

Where this fits

Credit, payments, and account holds

Whether a person gets credit, at what limit, and whether they can use the money or the account they already have.

Scored cases
Standards to adopt
Run first
Delegation audit. Take one hold or limit workflow through six questions. See which actions nobody can justify, and whether each can be undone.

Payout checks run at each release gate. Each payout receipt carries its evidence pack and links to its decision log entry. Together they give an auditor the record of each payout.

Terms used: Time transparency Stable clock Bounded duration Decision artifact Traceable ownership Safe pause Time to restore (TTR) Time to halt (TTH) Appeal passage rate

The full entry, and where the framework does less →