DecionisDevelopers
Policy pack

Ops Spend Control

Dual-gate governance for back-office spend — spend admission (completeness, valid amount, verified vendor, expense/refund/credit limits) and disbursement authority (authorized role, segregation of duties, dual authorization, duplicate-payment detection) before money moves.

Key
ops
Version
ops-spend-v1
Rules
12
Domain
OPS_DISBURSEMENT_AUTHORITY
Every packHow a pack decides

Rules, in the order the evaluator tries them

Highest priority first. The first rule whose conditions all hold decides; with none, the decision is a REVIEW.

  1. Duplicate payment / invoice suspected

    priority 210

    disb-duplicate-payment · *

    When
    • gate = "disbursement_authority"
    • duplicate_suspected = true
    Then

    AUTO_REJECT → REJECT · urgent

    A prior payment with the same vendor + invoice/amount fingerprint was found.

  2. Required spend fields present

    priority 200

    spend-required-fields · *

    When
    • gate = "spend_admission"
    • missing_required_fields > 0
    Then

    AUTO_REJECT → REJECT · urgent

    Spend request is incomplete; required fields must be present before admission.

  3. Actor holds an authorized disbursement role

    priority 200

    disb-authorized-role · *

    When
    • gate = "disbursement_authority"
    • actor_authorized = false
    Then

    AUTO_REJECT → REJECT · urgent

    Actor role is not authorized to release a disbursement.

  4. Spend amount is valid

    priority 195

    spend-amount-valid · *

    When
    • gate = "spend_admission"
    • amount_invalid = true
    Then

    AUTO_REJECT → REJECT · urgent

    Spend amount must be a positive numeric value.

  5. Segregation of duties enforced

    priority 195

    disb-segregation-of-duties · *

    When
    • gate = "disbursement_authority"
    • sod_violation = true
    Then

    AUTO_REJECT → REJECT · urgent

    Segregation-of-duties check failed because requester and approver match.

  6. Vendor is verified

    priority 190

    spend-vendor-verified · *

    When
    • gate = "spend_admission"
    • vendor_verified = false
    Then

    AUTO_REJECT → REJECT · urgent

    Vendor is not verified for governed disbursement.

  7. Refund exceeds the approval limit

    priority 185

    spend-refund-over-limit · *

    When
    • gate = "spend_admission"
    • refund_over_limit = true
    Then

    ESCALATE → ESCALATE · urgent · SLA 30 min

    Refund amount exceeds the configured refund approval limit.

  8. Credit exceeds the approval limit

    priority 180

    spend-credit-over-limit · *

    When
    • gate = "spend_admission"
    • credit_over_limit = true
    Then

    ESCALATE → ESCALATE · urgent · SLA 30 min

    Credit amount exceeds the configured credit approval limit.

  9. High-value disbursement requires dual authorization

    priority 180

    disb-dual-auth-missing · *

    When
    • gate = "disbursement_authority"
    • dual_auth_required = true
    • dual_auth_present = false
    Then

    ESCALATE → ESCALATE · urgent · SLA 10 min

    Disbursement exceeds the dual-authorization threshold and a second approver is missing.

  10. Over-threshold spend requires dual authorization

    priority 170

    spend-over-threshold-needs-dual-auth · *

    When
    • gate = "spend_admission"
    • over_expense_threshold = true
    • dual_auth_present = false
    Then

    REQUIRE_REVIEW → REVIEW · elevated · SLA 60 min

    Spend exceeds the approval threshold and lacks a second authorizer.

  11. Admit a clean spend request

    priority 1

    spend-admit-default · *

    When
    • gate = "spend_admission"
    Then

    AUTO_APPROVE → APPROVE

    Spend request is complete, within limits, and eligible for disbursement review.

  12. Authorize a clean disbursement

    priority 1

    disb-authorize-default · *

    When
    • gate = "disbursement_authority"
    Then

    AUTO_APPROVE → APPROVE

    Disbursement authority is present and no duplicate was detected.

Evaluate under it

Locally, with @decionis/mcp: the payload becomes the request's context, and its action the decision type. On the hosted protocol, once the bundle is stored for your organization, name vertical_pack, policy_version and require_exact_policy_version: true.

decionis_evaluate arguments

{ "policy_pack": "ops", "payload": { "action": "<decision type>" } }

In a hosted evaluate-decision request

"vertical_pack": "ops",
"policy_version": "ops-spend-v1",
"require_exact_policy_version": true

Workflow keys that resolve to this pack: expense_approval, vendor_payment, refund_approval, ap_disbursement.

What its rules read

Every fact below comes from the request's context.

  • actor_authorized
  • amount_invalid
  • credit_over_limit
  • dual_auth_present
  • dual_auth_required
  • duplicate_suspected
  • gate
  • missing_required_fields
  • over_expense_threshold
  • refund_over_limit
  • sod_violation
  • vendor_verified

Signals it maps

  • ops_spend_completeness_rateerp
  • ops_duplicate_payment_rateerp