What a decline is allowed to say

A rules engine answers in its own vocabulary: rule ids, working-memory facts, the margin floor that priced the decision. Hand that to whoever asked and consumers couple to names you can never rename — and an attacker who can submit transactions and read why they failed is running an oracle attack, binary-searching your thresholds one decline at a time. Tell them VELOCITY_LIMIT and they learn where the edge is. Tell them not_eligible and they learn nothing.

Scenario

Who is asking?

The engine's trace — what actually fired

What crosses the boundary — to a public caller

Held back

Everything the engine said that this audience does not get, and why.

Runs in your browser; the trace is editable, so break it and see what happens. loading warden… — this page does not reimplement warden, it compiles it: warden.wasm is the same Go, built with GOOS=js GOARCH=wasm, so the projection here cannot drift from the tool. Nothing is uploaded.

Both scenarios are invented, thresholds included. They illustrate one shape — a decision whose reasons are partly useful, partly sensitive, and partly an oracle — across four unrelated industries. None is any company's real ruleset.

The WebAssembly above carries the Go runtime, and wasm_exec.js beside it is the toolchain's own shim — both Copyright The Go Authors, redistributed under a BSD 3-Clause license. NOTICE says what is whose.