Rules-based controls
The most explainable layer. Used to enforce known policy in real time — every trigger is a rule you wrote, versioned and logged.
IF amount > 3× baseline
AND device = unrecognised
THEN hold_for_review()
// rule R-118 · v187 · logged