Define approved screening policies

Owners and administrators publish immutable policy versions in the dashboard. Each records its purpose, relevant jurisdictions, required and optional sources by subject type, exclusions, external checks, review requirements, monitoring cadence, and retention trigger. Source selection alone does not determine whether the policy satisfies your obligations.

GET /api/v1/policies, with sources:read, returns current policy versions and requirePolicy. GET /api/v1/policies/{id} returns the current version in the same items envelope. Policy publication and retirement require an authorized human session. Retirement blocks new use without rewriting the policy snapshot on earlier results.

Send policy as an object containing id and version alongside the usual subject and exactly one coverage selector. The server requires the policy’s sources for that subject type and permits only its required or optional sources. Missing required coverage, unsupported types, and retired or changed versions fail before a result is produced.

The resulting policySnapshot preserves the organization policy used for that screen. It is separate from versions.policy, which identifies matching rules. Production settings can require a published policy for every new screening; sandbox remains available for synthetic testing. Policy-backed monitors use the approved cadence.

{
  "subject": {
    "name": "Alex Morgan",
    "entityType": "person",
    "birthDate": "1984"
  },
  "package": "sandbox@1",
  "policy": {
    "id": "00000000-0000-4000-8000-000000000001",
    "version": 1
  }
}

An external check is a task for your reviewers. They record outstanding, completed externally with an evidence reference, or not applicable with a reason. The product does not automatically research ownership or control, calculate aggregate ownership, decide jurisdiction, grant a licence, or authorize a transaction.

Choose review_completed, relationship_ended, or business_event for the retention trigger. Review policy and organization settings can require a distinct eligible approver. Requirements cannot be removed from an individual case to bypass the policy.