Score card transactions for fraud, with permission

Every person in every organisation that uses Munitas signs in on this one page. Who signs in decides what the console shows afterwards: a person sees only the data that the person's own organisation owns.

The home page counts four things: datasets, sealed versions, versions released for wider use, and versions held back. A dataset is a named collection of records, and Munitas decides who may read it. A version is one state of a dataset, and sealed means finished and closed for good, so it can never be edited.

Bringing a dataset in takes three steps: register it, upload its files, then seal it. Here Lena registers it with a name, an owning department, Fraud Operations, and an access level. The access level says how restricted the data is, and Raw, the default, is the most restricted.

After registering, the same page offers to upload files. Lena uploads transactions.csv, a file of three card transactions. Each row names a cardholder and gives a full card number, taken from the payment networks' published test numbers, so no row describes a real person.

Sealing closes version 1 for good, and Munitas records a fingerprint of it: a value worked out from the exact contents, which changes if even one byte changes. Lena registered this dataset but cannot read it, because it is more sensitive than Lena's role may read. A request goes to the custodian of the owning department, the person who decides who may read its data.

card-transaction-summary was sealed at the Under review level and later released to Published, the most open level. A release changes who may read a version and moves no data. It was recorded as made by svc-fraud-pipeline, a workload, which is Munitas's word for a program acting on its own.

The agent list shows one agent, fraud-transaction-scoring. Its purpose is stated in words, it belongs to the Fraud Operations department, and its code is kept as sealed versions, the same way a dataset is.

Lena uploads a new version of the program's code. The only tool it may use is read_dataset_version, and it calls no AI model. The sample program prints one fixed result, so this walkthrough follows the permission flow and not real scoring. This is the program's first version, so the table has one row.

Lena deploys the new version, then names a purpose for a run, which is one execution of the program, and chooses card-transaction-log, a Raw dataset of Fraud Operations. Munitas warns before the click, not after.

A request is a written ask to read one dataset for one purpose. Marcus's home page lists those for Fraud Operations data. The first was filed automatically by Lena's run, for the program. The second is Omar's own request for the same Raw dataset, for another purpose.

Marcus grants the program's request, which creates a lease: permission to read one dataset for one purpose and for a limited time. This page has no screen for that click. The paused run then resumes by itself, in a container, an isolated environment with no network access of its own.

Naomi is the custodian of the Risk and Compliance department. The list holds one request, from Lena, to read a dataset named kyc-identity-documents, which Risk and Compliance owns. Neither the agent's request nor Omar's request appears here, because both are for Fraud Operations data.

Naomi pastes the address of a version that belongs to a different organisation on the same platform, the Health organisation. The console answers that no such version exists. It gives the same answer for an address that was never valid, so it does not even confirm that the version is there.

Omar is an analyst. The digest was released one step, from Raw to Under review, which sits between Raw and Published. It is still more sensitive than an analyst may read, so a lease is needed. The form asks for a purpose, a reason and a length of time.

Omar wrote a purpose and a reason, and asked for 24 hours. Marcus's list now shows the request for the digest first. It carries two options that the card for the Raw dataset below it does not have.

Choosing Any purpose, while this lasts changes what the lease will cover. Marcus is still choosing, and the page already states in words what granting would now do.

The request moves to the top of What you have decided, with a label that records the choice. Separately, a script asked the platform whether Omar could read the digest for a purpose that nobody mentioned when Marcus approved, an unplanned spot-check, and the policy allowed it. That check has no screen of its own.