Rule Authoring Skill

​

Overview

​

What It Helps With

• Creating custom rules from scratch or from pre-built templates
• Configuring conditions with property checks, boolean logic, and aggregation thresholds
• Setting up actions (alert creation, transaction halting)
• Managing rule lifecycle (draft, activate, disable, delete, versioning)
• Testing rules with on-demand evaluation
• Understanding how rules generate alerts in production

​

Quick Start

• “Create a rule that alerts on withdrawals over $50K in 24 hours”
• “Copy a rule template and customize the thresholds”
• “What aggregation operators are available for conditions?”
• “Test my rule against a sample transaction”
• “How do I update an active rule without downtime?”

​

What the Skill Knows

​

Rule Lifecycle

Create → Draft → Activate → Active → Disable → Disabled → Delete (soft)

• Only active rules evaluate incoming transactions automatically
• Updating an active rule creates a new version atomically
• Active rules must be disabled before deletion
• activate, disable, and delete accept optional reason for audit trail

​

Conditions

• Entity targets: transaction, client, wallet, bankAccount
• Boolean logic: all (AND) and any (OR) groups with arbitrary nesting
• Operators: equal, notEqual, greaterThan, lessThan, greaterThanInclusive, lessThanInclusive, contains, doesNotContain, startsWith, endsWith, in, notIn, between, isNull, isNotNull
• Prefix/suffix: startsWith / endsWith are case-insensitive (same as string contains). A missing fact does not match. Use these instead of contains when a mid-string hit would be a false positive (IDs, hashes, account numbers).
• Ranges: numeric facts (amount, balances, numeric custom fields) and dates accept between with an inclusive [min, max] array — for example { "entity": "transaction", "property": "amount", "operator": "between", "value": [1000, 50000] }
• Null checks: isNull / isNotNull (“is empty” / “is set” in the Rule Builder) take no value — they match fields that are missing, null, or an empty string "" (0 and false count as set). Only use them on facts that list them in supportedOperators: facts stored with a default (KYC Status, Activity Status, client Risk Score, built-in yes/no flags such as Is PEP) are never empty and do not offer them — use kycLevel for “KYC tier not set” and pepScore for “PEP screening not run”
• Entity relationships: all, sender, receiver for client-scoped conditions

​

Aggregation Thresholds

• Operators: sum, count, avg, min, max, median, stddev, percentile, countDistinct, first, last
• Time windows: in_the_last, all_time, after, before, between
• Periods: minutes, hours, days, weeks, months, years
• Filters: Narrow which transactions are aggregated (e.g., only withdrawals)

​

Actions

​

Templates

const { ruleId } = await client.ruleTemplates.copyRuleTemplate("template-id");
const updated = await client.rules.updateRule(ruleId, { /* customizations */ });
await client.rules.activateRule(ruleId);

​

Evaluation

• Automatic: Active rules evaluate every ingested transaction and trigger actions (alert creation)
• On-demand: POST /v1/evaluation/evaluate tests rules without creating alerts
• History: Query evaluation results by transaction or by rule

​

Key Distinction: Evaluate API vs Production Alerts

​

Common Mistakes It Prevents

​

Source