Loading…
Policy pack
Ops Spend Control
Dual-gate governance for back-office spend — spend admission (completeness, valid amount, verified vendor, expense/refund/credit limits) and disbursement authority (authorized role, segregation of duties, dual authorization, duplicate-payment detection) before money moves.
- Key
- ops
- Version
- ops-spend-v1
- Rules
- 12
- Domain
- OPS_DISBURSEMENT_AUTHORITY
Rules, in the order the evaluator tries them
Highest priority first. The first rule whose conditions all hold decides; with none, the decision is a REVIEW.
Duplicate payment / invoice suspected
priority 210disb-duplicate-payment · *
When- gate = "disbursement_authority"
- duplicate_suspected = true
ThenAUTO_REJECT → REJECT · urgent
A prior payment with the same vendor + invoice/amount fingerprint was found.
Required spend fields present
priority 200spend-required-fields · *
When- gate = "spend_admission"
- missing_required_fields > 0
ThenAUTO_REJECT → REJECT · urgent
Spend request is incomplete; required fields must be present before admission.
Actor holds an authorized disbursement role
priority 200disb-authorized-role · *
When- gate = "disbursement_authority"
- actor_authorized = false
ThenAUTO_REJECT → REJECT · urgent
Actor role is not authorized to release a disbursement.
Spend amount is valid
priority 195spend-amount-valid · *
When- gate = "spend_admission"
- amount_invalid = true
ThenAUTO_REJECT → REJECT · urgent
Spend amount must be a positive numeric value.
Segregation of duties enforced
priority 195disb-segregation-of-duties · *
When- gate = "disbursement_authority"
- sod_violation = true
ThenAUTO_REJECT → REJECT · urgent
Segregation-of-duties check failed because requester and approver match.
Vendor is verified
priority 190spend-vendor-verified · *
When- gate = "spend_admission"
- vendor_verified = false
ThenAUTO_REJECT → REJECT · urgent
Vendor is not verified for governed disbursement.
Refund exceeds the approval limit
priority 185spend-refund-over-limit · *
When- gate = "spend_admission"
- refund_over_limit = true
ThenESCALATE → ESCALATE · urgent · SLA 30 min
Refund amount exceeds the configured refund approval limit.
Credit exceeds the approval limit
priority 180spend-credit-over-limit · *
When- gate = "spend_admission"
- credit_over_limit = true
ThenESCALATE → ESCALATE · urgent · SLA 30 min
Credit amount exceeds the configured credit approval limit.
High-value disbursement requires dual authorization
priority 180disb-dual-auth-missing · *
When- gate = "disbursement_authority"
- dual_auth_required = true
- dual_auth_present = false
ThenESCALATE → ESCALATE · urgent · SLA 10 min
Disbursement exceeds the dual-authorization threshold and a second approver is missing.
Over-threshold spend requires dual authorization
priority 170spend-over-threshold-needs-dual-auth · *
When- gate = "spend_admission"
- over_expense_threshold = true
- dual_auth_present = false
ThenREQUIRE_REVIEW → REVIEW · elevated · SLA 60 min
Spend exceeds the approval threshold and lacks a second authorizer.
Admit a clean spend request
priority 1spend-admit-default · *
When- gate = "spend_admission"
ThenAUTO_APPROVE → APPROVE
Spend request is complete, within limits, and eligible for disbursement review.
Authorize a clean disbursement
priority 1disb-authorize-default · *
When- gate = "disbursement_authority"
ThenAUTO_APPROVE → APPROVE
Disbursement authority is present and no duplicate was detected.
Evaluate under it
Locally, with @decionis/mcp: the payload becomes the request's context, and its action the decision type. On the hosted protocol, once the bundle is stored for your organization, name vertical_pack, policy_version and require_exact_policy_version: true.
decionis_evaluate arguments
{ "policy_pack": "ops", "payload": { "action": "<decision type>" } }In a hosted evaluate-decision request
"vertical_pack": "ops",
"policy_version": "ops-spend-v1",
"require_exact_policy_version": trueWorkflow keys that resolve to this pack: expense_approval, vendor_payment, refund_approval, ap_disbursement.
What its rules read
Every fact below comes from the request's context.
- actor_authorized
- amount_invalid
- credit_over_limit
- dual_auth_present
- dual_auth_required
- duplicate_suspected
- gate
- missing_required_fields
- over_expense_threshold
- refund_over_limit
- sod_violation
- vendor_verified
Signals it maps
- ops_spend_completeness_rateerp
- ops_duplicate_payment_rateerp