03 / Evidence before authority
How do you evaluate payment controls in shadow mode?
Record what a control would decide for each proposed payment, using the information available at that moment. Compare it with the existing decision, then examine later outcomes, unnecessary holds and coverage. A shadow decision records a judgment; it does not block or authorize payment.
What did each control know at the moment of decision?
Follow the evidenceFreeze the question at decision time.
Capture the exact proposed payment, the original attempt's known state and the applicable authority before recording either decision. Preserve the policy version, evidence references and timing needed to review the comparison.
A later settlement may explain the exposure. It must not silently become information the shadow control supposedly knew earlier. Differences in data access or decision timing must be disclosed.
What should one record show?
- At 12:00 UTC
- Original path A is UNKNOWN. Payment through path B is proposed for the same obligation.
- Existing decision
- RELEASED · The existing path proceeded.
- Shadow decision
- HOLD · The original may still pay. Recorded only; no payment blocked.
- Later, at 13:00 UTC
- A duplicate effect is recorded in the fictional fixture. This later outcome was not used to produce the HOLD.
Matched information and timing are declared in the fixture, not independently authenticated. This is not a customer incident or proof of prevented loss.
The disagreement is a case to investigate. To estimate preventable exposure, separately establish whether the proposed control could have governed that path in time, under the stated operating assumptions.
Measure more than disagreement.
| Measure | Record | Interpretation |
|---|---|---|
| Comparable proposals | Observed proposals, matched decisions, exclusions and missing evidence. | State the denominator. Replays are not additional independent observations. |
| Unnecessary HOLDs | Review held proposals against agreed criteria and the evidence available at that moment. | A later safe outcome alone does not prove the earlier HOLD was unnecessary. |
| Coverage | Observed executable paths, manual routes, gaps and unknown coverage. | Do not generalize from visible proposals to unobserved paths. |
| Operational burden | Time to resolution, operator work and the effect of delayed legitimate payments. | In offline review, these are estimates unless independently observed. |
Keep unresolved cases separate. Point-in-time shadow decisions are not a simulation of the entire alternative future: enforcing an earlier HOLD could change the state presented to later proposals.
Map the declared paths with the coverage worksheet before interpreting what the observed proposals represent.
Inspect the basis
Put this question to the evidence.
- Inspect the recorded Shadow example
Separate the information available at the decision from the later fictional outcome.
- Check unnecessary blocking
A control must also permit required recovery when its conditions hold.
Recorded synthetic examples. These findings do not establish the behavior of your workflow.
Sources and limits
- HALTSEAL v0.4.2 source brief. Local results, source identities and reproduction limits.
- Decision and authority. What Assessment, Shadow and enforcement mean in the public model.
The delivered study contains eight fictional proposals across seven obligations. Actual buyer paths and native provider calls remain zero. It establishes neither customer value nor operational reliability. This guide describes a review method, not an available production enforcement service.