Identity with Fraud
Identity and Fraud are two services with two different jobs. Identity is a standalone evidence provider: it observes a session and produces an IdentityDecisionSnapshot — scores, per-family signals, a identityRiskLevel verdict, and, when configured, a signed assertion. It never blocks anything. Fraud is the decision maker: it takes that evidence (plus its own live signals) and produces an action — allow, force_3d, review or block.
When both run on the Lunixi platform, Fraud pulls identity's snapshot in-platform and layers it onto its own analysis. This section explains that bridge: how the snapshot is carried, how much it is trusted, how it changes a fraud decision, and which flow nodes read it.
The boundary is strict. Identity grades evidence; Fraud decides. There is no block/allow field anywhere in the snapshot — the only verdict identity emits is identityRiskLevel, an evidence-grade band. The allow/force_3d/review/block action belongs to Fraud Detection.
Two roles, one session
| Identity | Fraud | |
|---|---|---|
| Produces | IdentityDecisionSnapshot (evidence) | allow / force_3d / review / block (action) |
| Verdict field | identityRiskLevel (clean…critical) | the decision + reasonCodes |
| Signing | optional signed identityAssertion (non-repudiable, with expiresAt) | — |
| Acts on the session? | No | Yes |
The snapshot is graded to be decision-usable — that is what decisionGrade on the snapshot means: identity has enough evidence and freshness for a downstream decision to rely on it. But grading it is as far as identity goes. Fraud reads the graded evidence and owns the outcome.
How the two connect
Three things flow across the in-platform boundary. All of it travels over authenticated, internal gRPC bridges — there is no customer-facing endpoint to call for any of this.
- Fraud reads identity. When a fraud evaluation runs, it resolves the identity snapshot and its signed assertion for the session, then merges them onto its own live analysis. See Carrying the Snapshot.
- The snapshot is additive, never raw. Fraud's own live-signal analysis always runs; the identity snapshot rides on top of it. See Additive Evidence & Trusted Device.
- Fraud writes back to identity. After a decision is logged, Fraud feeds the outcome back so identity can aggregate risk and profile history for the subject.
The feedback loop
Once Fraud has decided, it calls recordDecisionIntelligence back into identity — the reverse direction of the read. It carries the fraud decision plus the plaintext signals that drove it, authorised with an identity:write scope, and it feeds identity's risk and profile aggregation for that device, IP and subject.
This write-back is fire-and-forget, best-effort. It runs after the decision is already logged and does not gate it; if it fails, the failure is swallowed silently. Treat identity's aggregated profile history as eventually enriched by fraud outcomes — not guaranteed on any single decision.
In this section
Next steps
- The Risk Snapshot — the
IdentityDecisionSnapshotfield reference - Assertions & JWKS — verifying a signed identity assertion
- Fraud Detection — the service that owns the decision