Device Risk Evidence to Decision Mainline

一笔请求的主线：观察环境，验证来源，归并身份，关联业务，分级处置，再用结果校准下一次判断

Device risk evidence to decision mainline Web, Android and edge observations become event-bound evidence, a probabilistic device profile, a business risk graph, a tiered decision and a governed feedback loop. 1 / OBSERVE 2 / VERIFY 3 / RESOLVE 4 / CONTEXTUALIZE 5 / DECIDE AND LEARN confirmed fraud, trusted challenge, appeal and drift update feature reliability, graph edges and policy thresholds Web and EdgeHTTP / TLS / runtime / behaviorfirst-party state + server observation Android Runtimescoped IDs / Build / app / sensorscollection failure remains explicit Event-bound Evidenceschema / action / nonce / timestamprequest signature + Play Integrityclient claims are not authorization Probabilistic Profilecandidate recall + similaritycollision / drift / split / mergeprofile ID + confidence + conflicts Business Risk Graphaccount / IP / order / paymentaddress / content / merchant / timetyped and decaying relationships Tiered Policyallow / limit / challengereview / delay / denyreason code + model version Governed Feedbackoutcome source + confidence + cooldownaging / rollback / appeal / deletion 看到了什么？谁看见的？ 能否验来源、绑定和新鲜度？ 像哪个历史环境？有多确定？ 这次业务关系是否异常？ 该增加多少摩擦？结果可信吗？

设备不是结论

  • 客户端只提交有来源和版本的观察值
  • 指纹输出画像候选和置信度，不输出业务授权
  • 完整性证明也必须绑定到本次关键动作

关系决定语义

  • 同一台设备登录、领券、付款的风险含义不同
  • 账号、网络、支付、地址和行为把设备节点放进场景
  • 国内外产品的差异主要发生在这一层

处置必须闭环

  • 放行与拒绝之间还应有限额、挑战和复核
  • 反馈来源不同，不能以同一权重更新画像
  • 安全效果、误伤、漂移和隐私成本一起验收

Device risk evidence mainline - Cocoon AI diagram - 2026-08-25