Policy and Enforcement

Policy in HYPR Affirm describes the rules that evaluate where a verification can take place and how the flow responds to risk signals. Policy composes on top of the verification steps in a workflow without changing the step composition itself.

This section is the concept home for policy. Per-step configuration of the policy-bearing steps (Location, Escalation) lives in Step Configuration.

Policy composition

A workflow can compose multiple policy controls. Each control evaluates independently and contributes to the per-step or per-flow outcome:

• Location policy — Known Locations, IP allow/block lists, distance threshold, country block list, optional multi-headquarters trust zones. Evaluated as part of the Location step.
• Risk-signal escalation policy — per-signal decision tree (escalate to manual review, auto-fail, allow to continue). Configured at the tenant default level and optionally overridden per workflow.

Evaluation order

Within the Location step, the policy controls evaluate in a deterministic order. The first definitive PASS or FAIL short-circuits the rest:

1. Country Block List
2. IP Address Allow / Block List (with Strict Enforcement applied where configured)
3. Known Locations (proximity to whitelisted locations)
4. Distance Threshold (against the requester's expected location from directory)

For multi-headquarters tenants, the Known Locations / Distance check evaluates against every configured headquarters and passes if the requester is within threshold of any.

For per-control configuration depth, see:

• Network and Location Policy — full reference for the Location-step policy controls including multi-HQ
• Affirm Risk Policy Builder — Control Center UI for building Policy Evaluation Kits (rules, predicates, signals, actions)
• Risk-Signal Escalation Policy — the policy model and how policy decisions surface in observability

How policy interacts with steps

• Policy controls fire within a verification step (Location runs its IP / distance / block checks before producing the step outcome)
• Risk-signal escalation fires across steps when any step produces a configured signal (document anomaly, biometric anomaly, location anomaly, network anomaly)
• The step-level retry / failure outcome configuration (see Injectable Outcomes & Retry Limits) decides what happens after policy fires — deny, redirect, continue, escalate

Related

• Affirm Risk Policy Builder — admin UI for building Policy Evaluation Kits
• Risk-Signal Escalation Policy — policy model + observability
• Network and Location Policy — Location policy deep-dive
• Location step — step-config-focused view of the same controls
• Escalation (concept) — two-mechanism overview (approver chain + risk signal)