[ { "productId": "entrust-onfido", "storyId": "agent-onboarding-decisions", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs show a structured, API-driven flow (workflow run → SDK token → webhook/polling → reports) with distinct report types (document, watchlist/PEP/sanctions/adverse media, facial similarity, repeat-fraud alerts) that provide machine-consumable results an automation could branch on. However, there is no explicit evidence of a documented schema for risk scores, standardized failure-reason codes, or example JSON payloads that an agent would parse to make branching decisions. Missing for 10: explicit result schema/field reference, enumerated failure/rejection reason codes, and sample structured payloads showing risk signal granularity.", "evidenceIds": [ "entrust-onfido-docs-3", "entrust-onfido-docs-4", "entrust-onfido-docs-8", "entrust-onfido-docs-9", "entrust-onfido-docs-10", "entrust-onfido-docs-5" ] }, { "productId": "entrust-onfido", "storyId": "agent-runs-verification", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "The API supports the core pipeline: create applicant/workflow run, obtain SDK/OAuth tokens with scoped client-credentials grants, and retrieve results via webhook or polling (docs-2,3,4,6). However there is no evidence of an MCP surface for agent access, and no explicit documentation of a 're-check' trigger endpoint distinct from creating a new workflow run. missing for 10: MCP server/tool surface for agentic access, explicit re-check/re-verification API, and any agent-oriented orchestration examples.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-3", "entrust-onfido-docs-4", "entrust-onfido-docs-6" ] }, { "productId": "entrust-onfido", "storyId": "agentic-agent-docs", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "An llms.txt file exists at documentation.identity.entrust.com/llms.txt and is directly probed returning HTTP 200 with structured content describing the API/SDK platform, confirming an agent can be pointed at it. Missing for 10: no evidence of broader agent-oriented doc formats (e.g., markdown-only mirrors, sitemap of llms-full.txt) or third-party confirmation that agents successfully consume it.", "evidenceIds": [ "entrust-onfido-probe-1", "entrust-onfido-docs-3" ] }, { "productId": "entrust-onfido", "storyId": "agentic-ai-insights", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification is an identity-proofing/verification API and SDK platform (document checks, facial similarity, watchlist screening, workflows), not a data-analytics or generative-AI insights product where users query their data for AI-generated suggestions. The story's axis is a category error for this product type.", "evidenceIds": [ "entrust-onfido-docs-1", "entrust-onfido-docs-9", "entrust-onfido-docs-10" ] }, { "productId": "entrust-onfido", "storyId": "agentic-autonomous-automation", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Workflow Studio provides no-code, drag-and-drop automation of verification workflows, and webhooks/polling allow asynchronous, background monitoring of workflow status rather than requiring active user polling — evidence of some autonomous background operation. However, this is workflow automation for identity checks, not an AI-native agentic automation framework (no mention of AI agent orchestration, scheduling, or LLM-driven decisioning). Missing for 10: evidence of AI-agent-specific automation setup, autonomous decision-making beyond fixed verification steps, and integration with agent frameworks.", "evidenceIds": [ "entrust-onfido-docs-1", "entrust-onfido-docs-4", "entrust-onfido-docs-3" ] }, { "productId": "entrust-onfido", "storyId": "agentic-builtin-assistant", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification is an identity-verification API/SDK/workflow platform, not an AI assistant product; there is no built-in conversational AI assistant to delegate tasks to. This axis is a category error for this product type.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "agentic-headless", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "The product exposes a full REST API (create applicant, create workflow run, webhooks, OAuth client-credentials tokens) that could be scripted headlessly in CI, and webhook/polling patterns support automation without UI interaction. However, the primary workflow-building tool is explicitly no-code/drag-and-drop, and there is no evidence of a CLI, SDK for CI pipelines, or documented headless/automation-testing use case. missing for 10: explicit CI/headless automation examples, CLI tooling, documented non-interactive test/staging workflows, and confirmation that Workflow Studio config can be version-controlled or scripted rather than GUI-only.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-3", "entrust-onfido-docs-4", "entrust-onfido-docs-6", "entrust-onfido-docs-1" ] }, { "productId": "entrust-onfido", "storyId": "agentic-mcp-client", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification is an identity-verification API/SDK platform, not an AI agent or assistant that consumes tools; MCP server integration is a wrong-axis question for this product category and there is no evidence of MCP support in the pack.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "agentic-mcp-server", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "agentic-nl-commands", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "agentic-official-cli", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "agentic-public-api", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Entrust provides a well-documented public API/SDK flow (applicant creation, workflow run, SDK token, webhook or polling for results) plus OAuth client-credentials authentication and webhook signature verification, all confirmed by a live llms.txt probe describing it as 'a comprehensive API and SDK platform'. missing for 10: independent/community corroboration of real-world API integration, and a direct link to a full API reference/OpenAPI spec beyond the docs snippets.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-3", "entrust-onfido-docs-4", "entrust-onfido-docs-5", "entrust-onfido-docs-6", "entrust-onfido-probe-1" ] }, { "productId": "entrust-onfido", "storyId": "agentic-scoped-keys", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "The docs show OAuth client-credentials grant for short-lived tokens and separate SDK tokens for capture flows, which provides some credential separation, but there is no explicit mention of scoped/least-privilege roles, permission granularity, or agent-specific credential issuance. missing for 10: explicit least-privilege/scoped role definitions, documentation of granting narrower API scopes per use-case or agent, and any AI-agent-specific credential workflow.", "evidenceIds": [ "entrust-onfido-docs-6", "entrust-onfido-docs-2" ] }, { "productId": "entrust-onfido", "storyId": "agentic-sdks", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Evidence confirms official SDKs exist (mobile/web SDKs, SDK tokens, migration guide from Smart Capture SDKs to new IDV SDKs) with documented API/webhook/auth flows, showing developers can build against them. However, there's no evidence of language-specific SDK repos, open-source code samples, versioning/release notes, or independent developer corroboration of build experience. Missing for 10: public SDK repository/language coverage details, code samples, independent developer testimonials, changelog/versioning transparency.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-3", "entrust-onfido-docs-6", "entrust-onfido-docs-11", "entrust-onfido-docs-13" ] }, { "productId": "entrust-onfido", "storyId": "agentic-webhooks", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Docs clearly document configurable webhook events to notify on workflow status changes, including signature verification via HMAC-SHA256, showing a supported webhook subscription mechanism. missing for 10: no documentation of event type granularity/catalog, no independent/hands-on corroboration, and no explicit mention of self-serve webhook management UI or retry/delivery guarantees.", "evidenceIds": [ "entrust-onfido-docs-4", "entrust-onfido-docs-5", "entrust-onfido-docs-3" ] }, { "productId": "entrust-onfido", "storyId": "aml-watchlist-screening", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Docs explicitly describe Watchlist reports covering Sanctions, PEPs, Monitored Lists, and Adverse Media, integrated into the same workflow/API/dashboard used for identity verification (single vendor, single API, unified webhook/review surface). missing for 10: no independent/hands-on corroboration of the unified review UI or case-management workflow for screening hits.", "evidenceIds": [ "entrust-onfido-docs-9", "entrust-onfido-docs-3", "entrust-onfido-docs-4" ] }, { "productId": "entrust-onfido", "storyId": "api-interactive-docs", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack shows conventional API/SDK documentation (auth, webhooks, workflow setup) but no mention of an interactive API reference, API explorer, or runnable code examples anywhere in the docs.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "api-machine-spec", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack shows extensive API/webhook documentation but no mention of a downloadable OpenAPI/Swagger spec or other machine-readable API definition file. As an API-driven platform, this axis is applicable, but no evidence supports it.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "api-sandbox", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack covers SDK tokens, webhooks, OAuth, and workflow tools but contains no mention of a sandbox/test environment separate from production for API or SDK testing. This is a fair axis for an API/SDK platform, but no evidence supports it.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "api-versioning-policy", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "The docs reference an 'api/latest' version and a migration guide for moving from Smart Capture SDKs to new IDV SDKs, implying some versioning and change management, but there is no explicit documented deprecation policy, version support timeline, or sunset schedule for APIs. missing for 10: explicit versioned API scheme (e.g., v1/v2 endpoints), a published deprecation/sunset policy, and timelines for backward compatibility.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-13" ] }, { "productId": "entrust-onfido", "storyId": "automation-bulk-operations", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence describes single-applicant workflows (create applicant → workflow run → SDK token → webhook) and no batch/bulk API endpoints, CSV bulk upload, or multi-item processing tools are documented. Bulk operations are a plausible axis for an identity verification API but no supporting evidence exists.", "evidenceIds": [ "entrust-onfido-docs-3", "entrust-onfido-docs-4" ] }, { "productId": "entrust-onfido", "storyId": "automation-rules-engine", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Workflow Studio provides a no-code, drag-and-drop rule builder for defining identity verification workflows, and webhooks let users trigger downstream actions automatically on workflow status change events, satisfying the event-driven automation story within the IDV domain. Missing for 10: detailed documentation of conditional/branching rule logic within Workflow Studio and independent/hands-on corroboration of the rule engine's flexibility.", "evidenceIds": [ "entrust-onfido-docs-1", "entrust-onfido-docs-4", "entrust-onfido-docs-3" ] }, { "productId": "entrust-onfido", "storyId": "automation-scheduled-jobs", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification is an identity verification/KYC API and SDK platform, not an automation/orchestration tool for scheduling recurring jobs or workflows; its 'workflows' refer to verification decision flows, not cron-like recurring job scheduling. This axis is a category error for this product type.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "automation-versioned-workflows", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of version history, review workflows, or rollback capabilities for Workflow Studio automations; documentation focuses on building workflows via no-code interface but omits versioning/rollback features entirely.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "biometric-consent-compliance", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers technical integration (SDKs, webhooks, workflow studio, watchlist/document reports) but contains no documentation addressing GDPR legal bases, BIPA or other US biometric statutes, or consent language guidance for biometric data handling.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "conversion-analytics", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers workflow configuration, SDK/webhook integration, document/watchlist checks, and fraud detection, but nothing about a dashboard or reporting feature showing pass rates, drop-off funnels, or completion time broken down by country/document type. No analytics or reporting evidence exists to support this founder-facing metrics story.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "data-retention-redaction", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "None of the evidence mentions documented data retention windows or a redaction/deletion API for PII; the docs cover workflow building, SDK tokens, webhooks, watchlist reports, and biometric features but nothing about data lifecycle controls. missing for 10: retention policy documentation, deletion/redaction API endpoints, and any mention of PII scrubbing on demand.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "database-identity-checks", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers document verification, biometric/facial checks, watchlist/PEP/sanctions screening, webhooks, and SDK auth flows, but contains no mention of document-free identity verification against SSN, national ID registries, or credit-header databases. Since this is a plausible capability for an IDV platform, absence of evidence means 'none' rather than 'na'.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "deepfake-injection-defense", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence documents general liveness via head-motion challenges (Motion feature) and repeat-face fraud alerts, but nothing names specific defenses against AI-generated faces, deepfakes, or camera-injection attacks as the story requires. Missing for 10: named deepfake detection capability, AI-generated/synthetic face detection, and camera/virtual-camera injection attack prevention documentation.", "evidenceIds": [ "entrust-onfido-docs-12", "entrust-onfido-docs-10" ] }, { "productId": "entrust-onfido", "storyId": "global-document-coverage", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Docs confirm the platform lets ops configure accepted documents by issuing country and document type (docs-8), implying broad multi-country/document-type support, but no published list enumerating supported countries or specific document types (passports, national IDs, licenses, residence permits) is provided in the evidence. Missing for 10: a published country/document-type coverage list, explicit mention of all four document categories, and any breadth metric (e.g., number of countries/documents supported).", "evidenceIds": [ "entrust-onfido-docs-8", "entrust-onfido-docs-11" ] }, { "productId": "entrust-onfido", "storyId": "hosted-verification-flow", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Docs describe the full server-side flow: create applicant, create workflow run (returns SDK token), collect document+selfie captures via drop-in/hosted SDK, and retrieve results via webhook or polling — exactly the no-build-your-own-capture-UI flow described in the story. Also supports Smart Capture Link as a hosted no-code option and webhook signature verification for secure result reads. missing for 10: no independent/hands-on developer corroboration (blog posts, sample repos, or third-party integration reports) confirming the drop-in/hosted redirect flow works end-to-end in practice.", "evidenceIds": [ "entrust-onfido-docs-3", "entrust-onfido-docs-2", "entrust-onfido-docs-4", "entrust-onfido-docs-5", "entrust-onfido-docs-7" ] }, { "productId": "entrust-onfido", "storyId": "kyb-business-verification", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "All evidence focuses on individual identity verification (document capture, facial similarity, watchlist/PEP checks on applicants, workflow studio for KYC flows) — there is no mention of business/registry lookups, UBO (ultimate beneficial owner) identification, or documented KYB (know-your-business) workflows chaining into KYC on owners.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "manual-review-queues", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack documents workflow orchestration, SDKs, webhooks, watchlist/document reports, and dashboard configuration, but nowhere describes a manual review queue that surfaces document images, extracted fields, and check results together, nor a feedback loop where reviewer decisions update the record. Missing for 10: explicit manual review queue documentation, evidence bundling for reviewers, and reviewer decision feedback into the applicant record.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "native-sdk-capture", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Evidence confirms native mobile SDKs (with NFC only via mobile SDK) and an SDK-token based capture flow, and the product name 'Smart Capture' implies guided capture, but there is no explicit documentation of glare/blur/edge-detection coaching or confirmation of iOS, Android, and web SDK parity. missing for 10: explicit glare/blur/edge-detection coaching documentation, confirmation of web SDK support, first-try capture UX detail.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-3", "entrust-onfido-docs-11", "entrust-onfido-docs-13", "entrust-onfido-docs-7" ] }, { "productId": "entrust-onfido", "storyId": "no-code-verification-links", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Smart Capture Link is documented as a low-/no-code frontend that lets ops verify individuals without engineering effort, aligning with the no-code link concept, and Workflow Studio supports drag-and-drop workflow setup without developers. However, there is no explicit mention of a shareable QR code option or a simple 'send a one-off link' flow from a dashboard for ad-hoc individuals like contractors or sellers. missing for 10: explicit QR code generation/sharing feature, documentation of an ops-friendly one-off invite/send flow, independent or hands-on confirmation of ease-of-use for non-technical ops staff.", "evidenceIds": [ "entrust-onfido-docs-7", "entrust-onfido-docs-1" ] }, { "productId": "entrust-onfido", "storyId": "ongoing-monitoring", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence documents one-time Watchlist Reports (sanctions, PEP, monitored lists, adverse media) run during a verification workflow, plus webhooks that notify on workflow status changes — but nothing describes ongoing/continuous re-screening of previously verified applicants against watchlist updates or dedicated 'watchlist changed' events after the initial check.", "evidenceIds": [ "entrust-onfido-docs-9", "entrust-onfido-docs-4" ] }, { "productId": "entrust-onfido", "storyId": "openness-api-parity", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Core verification actions (create applicant, start workflow run, obtain SDK token, retrieve results via webhook/polling) are documented as API operations, but Workflow Studio (workflow building) and Dashboard-based document-acceptance configuration are explicitly positioned as no-code/low-code UI tools 'without the need for developer involvement,' with no documented API equivalent for authoring or editing workflows/rules themselves. Missing for 10: API/SDK endpoints for programmatically creating or editing workflows and document-acceptance rules equivalent to what Workflow Studio and the Dashboard provide, and confirmation that NFC or other SDK-only features are reachable via pure API calls.", "evidenceIds": [ "entrust-onfido-docs-1", "entrust-onfido-docs-3", "entrust-onfido-docs-7", "entrust-onfido-docs-8", "entrust-onfido-docs-11" ] }, { "productId": "entrust-onfido", "storyId": "openness-full-export", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification is an identity-verification/KYC API and SDK platform, not a data-hosting product with a user-facing data export/portability feature for end users; 'export all data and leave' is a category error for this kind of B2B verification infrastructure.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "openness-open-license", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification is a closed commercial SaaS/SDK identity-verification product; there is no indication it is or could be an open-source project. Source availability under an open license is not a relevant axis for this kind of proprietary vendor platform.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "openness-self-host", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification (Onfido) is a cloud SaaS identity verification API/SDK platform; self-hosting the core product is not an offered deployment model and is a category error for this type of managed compliance/verification service, not a missing feature.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "phone-email-risk-signals", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack documents document reports, facial similarity/liveness, watchlist/PEP/sanctions checks, and duplicate-face detection, but contains no mention of phone, email, carrier, address history, or device fingerprint risk signals as check types. missing for 10: phone risk check docs, email risk check docs, carrier/device fingerprint check docs, address history check docs.", "evidenceIds": [ "entrust-onfido-docs-8", "entrust-onfido-docs-9", "entrust-onfido-docs-10", "entrust-onfido-docs-12" ] }, { "productId": "entrust-onfido", "storyId": "privacy-data-residency", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack mentions data residency, regional storage options, or data localization controls for Entrust Identity Verification; the docs cover workflow building, SDK tokens, webhooks, and verification reports but say nothing about where data is stored or user choice of region.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "privacy-no-training", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "This story targets AI-native users seeking control over AI training data usage, which is not a relevant axis for an identity verification/KYC platform like Entrust Onfido; the evidence pack covers document verification, workflows, watchlists, and SDKs with no mention of AI training data opt-outs. This is a category mismatch rather than a missing capability.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "privacy-retention-controls", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack covers workflow building, SDK/API auth, webhooks, document/watchlist checks, and fraud detection, but contains no mention of data retention policies, deletion controls, or user-facing privacy/data lifecycle management. No documentation excerpt addresses how users or AI-native integrators can configure retention periods or trigger deletion of collected identity data.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "privacy-telemetry-optout", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Entrust Identity Verification (Onfido) is an identity-verification API/SDK platform, not an AI coding tool or agent product with telemetry/usage-tracking opt-out settings relevant to an AI-native developer workflow; this axis is a category error for this product type.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "repeat-fraud-detection", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs explicitly describe a facial deduplication feature that flags faces already seen in prior verification flows, directly addressing repeat-identity detection under different names. However, evidence lacks detail on document-level duplicate detection, how matches are surfaced/scored to a risk analyst, or independent/hands-on validation of accuracy. Missing for 10: document dedup evidence, analyst-facing reporting/UI detail, independent corroboration of detection accuracy.", "evidenceIds": [ "entrust-onfido-docs-10" ] }, { "productId": "entrust-onfido", "storyId": "reusable-verifications", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The docs describe repeat-face detection for fraud purposes (flagging faces that already went through verification) but this is a fraud-detection alert, not a documented mechanism for reusing a prior passed check to skip re-verification across sessions or products. No evidence of a 'reusable identity' or portable verification token/credential feature.", "evidenceIds": [ "entrust-onfido-docs-10" ] }, { "productId": "entrust-onfido", "storyId": "sandbox-test-verifications", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of a sandbox environment with documented test documents, personas, or magic values that deterministically produce pass/fail/review outcomes; the pack only covers workflow setup, SDK tokens, webhooks, and report types. missing for 10: sandbox/test-mode documentation, sample test documents or personas, deterministic magic-value test data for triggering specific verification outcomes.", "evidenceIds": [] }, { "productId": "entrust-onfido", "storyId": "selfie-match-liveness", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm a facial similarity/liveness check using motion challenges (head turns, randomized movements) to match selfie to document portrait, but there is no explicit documentation describing specific defenses against printed photos, screen replays, or video replay attacks. Missing for 10: explicit anti-spoofing detail (printed photo, screen, deepfake/video replay countermeasures), independent testing/accuracy corroboration.", "evidenceIds": [ "entrust-onfido-docs-12" ] }, { "productId": "entrust-onfido", "storyId": "session-lifecycle-api", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs confirm core lifecycle steps — create applicant, create workflow run, obtain SDK token, retrieve results via webhook or polling — plus authentication (OAuth) and webhook signature verification are documented. However, explicit API-level documentation for retrieving captured media, and for cancel/redact operations, is not shown in the evidence pack. missing for 10: documented endpoint/example for retrieving captured media via API, documented cancel operation, documented redact/delete operation, and independent confirmation these work end-to-end.", "evidenceIds": [ "entrust-onfido-docs-2", "entrust-onfido-docs-3", "entrust-onfido-docs-4", "entrust-onfido-docs-5", "entrust-onfido-docs-6" ] }, { "productId": "entrust-onfido", "storyId": "structured-data-extraction", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence describes workflow results retrievable via webhook or polling and a 'document report' concept, but nothing explicitly confirms that structured fields (name, DOB, document number, address, expiry) are returned as retrievable API data rather than a report/pass-fail outcome. Missing for 10: explicit API/webhook payload schema or docs showing per-field extracted data (name, DOB, doc number, address, expiry) returned to developers.", "evidenceIds": [ "entrust-onfido-docs-3", "entrust-onfido-docs-4", "entrust-onfido-docs-8" ] }, { "productId": "entrust-onfido", "storyId": "verification-webhooks", "verdict": "partial", "quality": 7, "confidence": "medium", "rationale": "Docs confirm webhooks can be configured to asynchronously notify status changes on workflow runs, with signed payloads verified via HMAC-SHA256, letting developers avoid polling. However, the pack never enumerates the specific lifecycle states (created, processing, verified, requires-input) claimed in the story, so exact event coverage is unconfirmed. missing for 10: explicit list of webhook event types/payload schema, independent confirmation of event granularity.", "evidenceIds": [ "entrust-onfido-docs-4", "entrust-onfido-docs-5", "entrust-onfido-docs-3" ] }, { "productId": "entrust-onfido", "storyId": "workflow-rules-routing", "verdict": "partial", "quality": 7, "confidence": "medium", "rationale": "Workflow Studio is explicitly documented as a no-code, drag-and-drop tool for building/maintaining/updating workflows without developer involvement, and the Dashboard lets ops filter accepted documents by issuing country — both directly support code-free verification-logic configuration. However, the evidence never explicitly confirms conditional branching or risk-based routing logic within Workflow Studio, only general workflow building and document/country filtering. Missing for 10: explicit documentation of conditional-step/risk-based routing configuration, and independent/hands-on confirmation that template changes deploy live without engineering involvement.", "evidenceIds": [ "entrust-onfido-docs-1", "entrust-onfido-docs-7", "entrust-onfido-docs-8" ] }, { "productId": "persona", "storyId": "agent-onboarding-decisions", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Persona's API/webhook model exposes inquiries, verifications, reports, and workflow decisioning as structured resources that could be consumed programmatically, and webhooks notify integrators of lifecycle events for branching logic. However the evidence never shows a concrete schema of machine-readable risk signals or enumerated failure/decline reasons an agent could parse. Missing for 10: example API/webhook payloads showing explicit risk-signal fields, structured failure-reason codes, and documentation confirming these are designed for autonomous agent branching rather than human review dashboards.", "evidenceIds": [ "persona-docs-2", "persona-docs-5", "persona-docs-6", "persona-docs-4" ] }, { "productId": "persona", "storyId": "agent-runs-verification", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows a general REST API, webhooks, sandbox, and docs for inquiries/workflows, but nothing about scoped API credentials for agent use, session polling/re-check triggering designed for AI agents, or any MCP surface at all.", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-agent-docs", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Persona hosts an llms.txt file (confirmed via direct probe returning HTTP 200) with explicit instructions for AI agents on how to fetch clean Markdown docs, and the docs themselves are consistently available in .md form as referenced throughout the evidence pack. missing for 10: no independent/third-party corroboration of agent usage, and no explicit sitemap of all docs within llms.txt shown.", "evidenceIds": [ "persona-probe-1", "persona-docs-1" ] }, { "productId": "persona", "storyId": "agentic-ai-insights", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence covers identity verification, workflows, webhooks, and testing tools but contains no mention of AI-generated insights or suggestions derived from user data within the product.", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-autonomous-automation", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Persona's Workflows feature explicitly automates repetitive manual decisions and decreases manual review time, and webhooks enable event-driven background reactions, giving a foundation for autonomous background automation within identity verification. However, this is domain-specific (identity/compliance) automation, not general-purpose agentic task automation, and there's no evidence of scheduling, triggers beyond identity events, or broader autonomous agent orchestration. Missing for 10: evidence of general-purpose scheduled/autonomous automation beyond identity workflows, independent confirmation of autonomous background execution, and detail on how workflows run without human intervention.", "evidenceIds": [ "persona-docs-5", "persona-docs-2" ] }, { "productId": "persona", "storyId": "agentic-builtin-assistant", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is an identity verification/compliance API platform, not a product with a built-in AI assistant UI for task delegation; this axis is a category error for its product type.", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-headless", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Persona is API-first and provides a sandbox with 'Simulate Actions' explicitly designed for programmatic/CI-style integration testing (persona-docs-9, persona-docs-3), implying headless automation is possible. However, there is no explicit CLI, SDK automation guide, or CI pipeline documentation describing headless operation for AI-native workflows. Missing for 10: dedicated CI/headless automation guide, CLI or agent-facing tooling, explicit statement of non-interactive/headless operation modes.", "evidenceIds": [ "persona-docs-9", "persona-docs-3", "persona-docs-1" ] }, { "productId": "persona", "storyId": "agentic-mcp-client", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is an identity verification/compliance API platform, not an AI agent or assistant; MCP server plug-in for tool use is a category mismatch and not a fair axis for this product type.", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-mcp-server", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-nl-commands", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-official-cli", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-public-api", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Persona provides a well-documented public API covering core resources (inquiries, workflows, reports, webhooks), sandbox/simulate testing tools, and an llms.txt for AI-agent consumption, enabling programmatic driving of the product. Missing for 10: independent/hands-on developer corroboration and explicit SDK/language client examples beyond docs claims.", "evidenceIds": [ "persona-docs-1", "persona-docs-2", "persona-docs-3", "persona-docs-9", "persona-probe-1" ] }, { "productId": "persona", "storyId": "agentic-scoped-keys", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-sdks", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers Persona's API reference, webhooks, sandbox testing, and inquiry/workflow docs, but nowhere mentions official client SDKs or language-specific libraries for developers to build against. Missing for 10: any mention of published SDKs (e.g., Node, Python, Ruby, Java) or SDK documentation/repos.", "evidenceIds": [] }, { "productId": "persona", "storyId": "agentic-webhooks", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Persona's docs explicitly confirm webhooks notify subscribers about events on any Persona resource, directly supporting event subscription via webhooks. Missing for 10: details on webhook payload structure, signature verification, event type filtering/configuration UI, and independent/hands-on confirmation of reliability.", "evidenceIds": [ "persona-docs-2" ] }, { "productId": "persona", "storyId": "aml-watchlist-screening", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack describes Persona's general identity verification, workflows, reports, and inquiry templates, but none of the citations specifically mention sanctions, PEP, or adverse-media watchlist screening as part of the reports or verification suite. Without explicit documentation of a watchlist/sanctions screening report or API, this capability cannot be confirmed from the evidence.", "evidenceIds": [ "persona-docs-6", "persona-docs-1" ] }, { "productId": "persona", "storyId": "api-interactive-docs", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows standard API reference docs, sandbox/testing tools, and llms.txt for AI agents, but no mention of an interactive API reference with runnable/executable code examples (e.g., embedded try-it console).", "evidenceIds": [] }, { "productId": "persona", "storyId": "api-machine-spec", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows extensive API reference docs and an llms.txt file for AI-friendly markdown access, but nothing indicates a downloadable machine-readable spec like an OpenAPI/Swagger file or equivalent schema. missing for 10: OpenAPI/Swagger spec file, any explicit machine-readable schema download link.", "evidenceIds": [ "persona-docs-1", "persona-probe-1" ] }, { "productId": "persona", "storyId": "api-sandbox", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Persona provides explicit sandbox mode where no real verifications or charges occur, plus integration-testing simulate actions to replicate inquiry/verification lifecycle behavior for programmatic testing without touching production data. missing for 10: independent/third-party corroboration of sandbox data isolation and more detail on how sandbox-to-production promotion works.", "evidenceIds": [ "persona-docs-3", "persona-docs-9" ] }, { "productId": "persona", "storyId": "api-versioning-policy", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack contains no mention of API versioning scheme or a documented deprecation policy anywhere in the docs; only general API/product feature descriptions are present. This is an applicable axis for an API-driven identity platform, so absence of evidence yields 'none'.", "evidenceIds": [] }, { "productId": "persona", "storyId": "automation-bulk-operations", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "Evidence covers identity verification workflows, inquiries, reports, and testing, but no mention of any bulk/batch operations API (e.g., bulk case creation, bulk report retrieval, batch processing endpoints) for AI-native automation. Absence of evidence for an applicable capability yields none.", "evidenceIds": [] }, { "productId": "persona", "storyId": "automation-rules-engine", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Persona's Workflows are documented as a way to automate repetitive manual decisions and decrease manual review time, and Webhooks notify external services about events on Persona resources, together enabling rule-based, event-triggered automation. However, the evidence lacks detail on how rules/conditions are authored (e.g., API-driven or only via a GUI workflow builder), and there is no independent or hands-on confirmation of this automation depth. Missing for 10: documentation on programmatic rule creation/API access to Workflows, and independent verification of automation behavior.", "evidenceIds": [ "persona-docs-5", "persona-docs-2" ] }, { "productId": "persona", "storyId": "automation-scheduled-jobs", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is an identity verification/compliance API platform, not a workflow/task scheduling tool; 'workflows' here refer to event-driven decisioning pipelines triggered by identity events, not recurring cron-like job scheduling for AI-native automation. This axis is a category error for this product type.", "evidenceIds": [] }, { "productId": "persona", "storyId": "automation-versioned-workflows", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Persona's Workflows feature (docs-5) supports automation of decisioning, so the axis of versioning/reviewing/rolling back automations is applicable, but no evidence describes version history, review/approval flows, or rollback capability for Workflows or Inquiry Templates. Missing for 10: workflow version history, change review/approval process, rollback/revert mechanism.", "evidenceIds": [ "persona-docs-5", "persona-docs-4" ] }, { "productId": "persona", "storyId": "biometric-consent-compliance", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "None of the evidence addresses legal bases for biometric data processing, GDPR compliance, BIPA or other US biometric statutes, or model consent language — the docs pack only covers API mechanics, webhooks, sandbox testing, and inquiry/workflow configuration.", "evidenceIds": [] }, { "productId": "persona", "storyId": "conversion-analytics", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers inquiries, workflows, webhooks, sandbox testing, and reports, but nothing describes a dashboard or analytics feature showing pass rates, drop-off points, or completion time broken down by country or document type. Missing for 10: any mention of an analytics/reporting dashboard, funnel metrics, drop-off analysis, or country/document-type breakdowns.", "evidenceIds": [] }, { "productId": "persona", "storyId": "data-retention-redaction", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack covers Persona's API, webhooks, sandbox mode, inquiry templates, workflows, and reports, but contains no mention of data retention windows, PII redaction, or a deletion API. Missing for 10: documented retention policy, redaction/deletion API endpoints, evidence of on-demand PII scrubbing.", "evidenceIds": [] }, { "productId": "persona", "storyId": "database-identity-checks", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack only describes generic Persona concepts (API, webhooks, workflows, reports, inquiry templates) but never mentions SSN checks, credit-header/database verification, or document-free flows explicitly. Missing for 10: no docs on SSN/national-registry verification methods, no mention of credit-header data checks, no example of a document-free inquiry template.", "evidenceIds": [ "persona-docs-6", "persona-docs-4" ] }, { "productId": "persona", "storyId": "deepfake-injection-defense", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "None of the evidence names specific liveness/deepfake/camera-injection detection capabilities; the pack only covers general API, webhooks, workflows, and testing tools with no mention of anti-spoofing or AI-generated face defenses.", "evidenceIds": [] }, { "productId": "persona", "storyId": "global-document-coverage", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers Persona's API, webhooks, sandbox, workflows, inquiry templates, and reports, but none of the cited docs actually publish a supported list of countries or document types (passports, national IDs, driver licenses, residence permits). Absence of this published coverage list means the specific ops-facing claim cannot be verified.", "evidenceIds": [ "persona-docs-1", "persona-docs-4", "persona-docs-6" ] }, { "productId": "persona", "storyId": "hosted-verification-flow", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Persona's docs explicitly describe a Hosted Flow ('Redirect users to a Persona-hosted page... no frontend code required'), inquiry templates that define verification screens/decisioning, webhooks to read results, and sandbox/testing tools — matching the story's server-side session + redirect/embed + read-result pattern. Missing for 10: explicit mention of a 'drop-in' embeddable widget (only hosted flow is named), explicit document+selfie combination flow details, and a concrete server-side session-creation API example.", "evidenceIds": [ "persona-docs-8", "persona-docs-4", "persona-docs-2", "persona-docs-3", "persona-docs-9" ] }, { "productId": "persona", "storyId": "kyb-business-verification", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers Persona's individual identity verification (inquiries, workflows, reports, sandbox testing) but nothing about business verification, registry lookups, UBO identification, or KYB flows chaining into KYC on owners is mentioned anywhere in the pack.", "evidenceIds": [] }, { "productId": "persona", "storyId": "manual-review-queues", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Persona docs reference Workflows that automate decisions and 'decrease manual review time' and Reports/Inquiry data that could feed a review process, implying a manual review step exists, but there is no direct evidence of a review queue UI showing document images, extracted fields, and check results together, or of reviewer decisions writing back into the inquiry record. Missing for 10: explicit case-management/review queue documentation, evidence-bundling UI details, and confirmation that reviewer decisions update the verification record.", "evidenceIds": [ "persona-docs-5", "persona-docs-6", "persona-docs-4" ] }, { "productId": "persona", "storyId": "native-sdk-capture", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "Evidence pack contains only high-level docs about API, webhooks, workflows, and hosted flow setup, with no mention of native iOS/Android/web SDKs or guided camera capture features like glare, blur, and edge detection coaching.", "evidenceIds": [] }, { "productId": "persona", "storyId": "no-code-verification-links", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs confirm a Hosted Flow option that requires no frontend code and can be shared as a link, supporting the no-code link fabric of the story, but there is no explicit evidence of QR code generation or of an ops-lead self-service dashboard flow for sending one-off verification links without engineering involvement. missing for 10: QR code generation, non-engineer/self-service link creation workflow, independent corroboration.", "evidenceIds": [ "persona-docs-8", "persona-docs-4" ] }, { "productId": "persona", "storyId": "ongoing-monitoring", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers Persona's general verification, webhooks, workflows, and reports, but nothing addresses watchlist screening specifically, let alone continuous re-screening of previously verified users against watchlist updates. Webhooks (persona-docs-2) notify on generic resource events but there's no documented watchlist-monitoring feature or recurring screening mechanism tied to it.", "evidenceIds": [] }, { "productId": "persona", "storyId": "openness-api-parity", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Persona exposes a broad API (inquiries, reports, webhooks, sandbox testing) covering the core verification workflow, but the evidence shows templates and Workflows are configured as visual building blocks (dashboard-defined 'screens, verifications, decisioning, theming') rather than something explicitly created/edited via API calls, so full UI/API parity isn't demonstrated. missing for 10: explicit evidence that inquiry templates and workflow logic can be authored/edited via API (not just triggered), and confirmation there's no dashboard-only configuration step required.", "evidenceIds": [ "persona-docs-1", "persona-docs-4", "persona-docs-5", "persona-docs-7", "persona-docs-9" ] }, { "productId": "persona", "storyId": "openness-full-export", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is an identity-verification/compliance API platform, not a data-hosting product where an end user accumulates personal content to export and leave with; the 'export all my data and leave' data-portability story is a category error for this product type.", "evidenceIds": [] }, { "productId": "persona", "storyId": "openness-open-license", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is a closed-source identity verification SaaS/API platform; there is no indication its source code is open at all. Source availability is not a relevant axis for a proprietary hosted verification service in the way it would be for an open-source library or framework, and no evidence suggests otherwise.", "evidenceIds": [] }, { "productId": "persona", "storyId": "openness-self-host", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is a hosted SaaS identity-verification API/service; self-hosting the core product is a category error for this type of product, not an evidenced gap.", "evidenceIds": [] }, { "productId": "persona", "storyId": "phone-email-risk-signals", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence only mentions generic 'Reports' providing additional info beyond inquiry submissions, but there is no documentation of specific phone, email, device fingerprint, carrier check, or address history check types. missing for 10: phone risk report docs, email risk report docs, device fingerprinting docs, carrier check docs, address history docs.", "evidenceIds": [ "persona-docs-6" ] }, { "productId": "persona", "storyId": "privacy-data-residency", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "No evidence in the pack mentions data residency, regional storage options, or compliance controls letting users choose where data is stored; the docs cover API, webhooks, sandbox, workflows, and inquiries only.", "evidenceIds": [] }, { "productId": "persona", "storyId": "privacy-no-training", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack addresses AI-model training data usage or opt-out controls for Persona; the docs cover identity verification, workflows, and testing but nothing about AI training data policies.", "evidenceIds": [] }, { "productId": "persona", "storyId": "privacy-retention-controls", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers Persona's identity verification API, webhooks, sandbox testing, and workflows, but contains no documentation of data retention policies, deletion controls, or user-facing privacy management APIs. Nothing in the evidence addresses how an AI-native user could control retention windows or trigger deletion of stored PII/verification data.", "evidenceIds": [] }, { "productId": "persona", "storyId": "privacy-telemetry-optout", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Persona is an identity verification/compliance API product, not an AI coding tool or agent with telemetry settings relevant to an 'AI-native user' workflow; the evidence pack contains no mention of telemetry or usage tracking opt-out, and this axis is a category mismatch for this kind of product.", "evidenceIds": [] }, { "productId": "persona", "storyId": "repeat-fraud-detection", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence describes general Reports, inquiries, and reference-ID linking but never mentions automatic cross-verification duplicate/repeat identity detection (e.g., matching the same face or document under different names). This is a plausible capability for an identity verification platform, so the axis applies, but no evidence supports it here.", "evidenceIds": [ "persona-docs-6", "persona-docs-10" ] }, { "productId": "persona", "storyId": "reusable-verifications", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Persona supports linking multiple inquiries to the same underlying Account via a shared reference ID, which is the documented mechanism for recognizing a previously verified person across sessions/products, but the evidence pack doesn't show explicit re-verification logic that skips a full check re-run or reuses a prior passed verification result. Missing for 10: explicit documentation of automatic reuse/skip-of-full-verification logic, cross-product verification portability, and any 'verified once, reused elsewhere' workflow description.", "evidenceIds": [ "persona-docs-10", "persona-docs-5" ] }, { "productId": "persona", "storyId": "sandbox-test-verifications", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Persona documents sandbox mode with no usage charges and no real verifications performed, plus a dedicated integration-testing doc describing 'Simulate Actions' to evoke specific Inquiry/Verification lifecycle behaviors for programmatic testing — this maps to deterministic pass/fail/review triggering. However, the evidence does not spell out concrete magic values or a full documented enumeration of every possible outcome (e.g., specific review-state triggers), so coverage of 'every outcome' is not fully substantiated. missing for 10: explicit list of magic values/test documents mapped to each outcome, independent/hands-on confirmation that simulate actions reliably produce all three outcome types.", "evidenceIds": [ "persona-docs-3", "persona-docs-9" ] }, { "productId": "persona", "storyId": "selfie-match-liveness", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack covers general Persona API/product features (webhooks, sandbox, workflows, reports, hosted flow) but contains no documentation of selfie/liveness verification mechanics or anti-spoofing defenses against printed photos, screens, or replayed video.", "evidenceIds": [] }, { "productId": "persona", "storyId": "session-lifecycle-api", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Docs confirm a broad API surface (inquiries, workflows, reports, webhooks, sandbox testing) implying session creation and reference-linking, but the evidence never explicitly documents status-check endpoints, retrieving captured media, or cancel/redact operations via API. missing for 10: explicit endpoint docs for get-status, retrieve captured media, cancel inquiry, and redact/delete data.", "evidenceIds": [ "persona-docs-1", "persona-docs-6", "persona-docs-9", "persona-docs-10" ] }, { "productId": "persona", "storyId": "structured-data-extraction", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "Persona is an identity verification platform where extracting structured document fields via API is a core plausible capability, but the evidence pack contains no documentation confirming that verified sessions return structured fields (name, DOB, document number, address, expiry) through the API — only generic references to inquiries, reports, and workflows.", "evidenceIds": [] }, { "productId": "persona", "storyId": "verification-webhooks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm Persona webhooks notify services about events on any resource, supporting event-driven reaction without polling, but no evidence explicitly lists signed payload verification or the specific lifecycle event names (created, processing, verified, requires-input). missing for 10: documentation of webhook signature verification mechanism, explicit enumeration of inquiry lifecycle event types/names, and example payloads showing event schema.", "evidenceIds": [ "persona-docs-2" ] }, { "productId": "persona", "storyId": "workflow-rules-routing", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Persona's Workflows and Inquiry/Dynamic Flow Templates support no-code configuration of decisioning, conditional logic, and templating (persona-docs-4,5,7), which are core building blocks for ops-led verification orchestration without engineering deploys. However, the evidence never explicitly confirms a no-code UI for risk-based routing or country-specific requirement configuration, nor does it describe the actual Workflow Builder interface. missing for 10: explicit documentation/screenshots of the drag-and-drop Workflow Builder UI, country-specific rule configuration examples, and independent/hands-on confirmation that ops (non-engineers) can make these changes without any deploy.", "evidenceIds": [ "persona-docs-4", "persona-docs-5", "persona-docs-7" ] }, { "productId": "plaid-idv", "storyId": "agent-onboarding-decisions", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Plaid IDV exposes structured webhook events (STEP_UPDATED, STATUS_UPDATED, RETRIED) and per-session risk signals (email/phone risk, overall risk score) that a workflow could branch on, plus conditional check logic in templates. However, evidence doesn't show a documented API response schema with explicit machine-readable failure-reason codes for programmatic branching, and there's no independent/hands-on confirmation of how granular or reliable these signals are for automated agent decisioning. Missing for 10: explicit API/webhook payload schema with structured failure-reason enums, and independent corroboration of agent-usable structured outputs.", "evidenceIds": [ "plaid-idv-docs-3", "plaid-idv-docs-11", "plaid-idv-docs-2", "plaid-idv-docs-5" ] }, { "productId": "plaid-idv", "storyId": "agent-runs-verification", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Plaid IDV has a documented API/webhook model (create sessions, poll status via STEP_UPDATED/STATUS_UPDATED/RETRIED events, retrieve data) and an official MCP server is referenced, suggesting some agent-friendly surface exists. However, there is no evidence describing scoped credentials for agent use, no documentation of MCP tools specifically exposing IDV session creation/polling/data retrieval/re-check triggers, and no confirmation of programmatic re-check triggering beyond dashboard override. missing for 10: MCP server tool documentation specific to IDV endpoints, scoped/least-privilege credential model for agents, programmatic re-check/retry trigger via API, independent confirmation of agent usage.", "evidenceIds": [ "plaid-idv-docs-3", "plaid-idv-docs-7", "plaid-idv-probe-4" ] }, { "productId": "plaid-idv", "storyId": "agentic-agent-docs", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Plaid does have a confirmed llms.txt at plaid.com/llms.txt and a documented MCP server, showing some agent-oriented infrastructure, but the llms.txt content is generic (not IDV-specific) and the docs-as-markdown probe for the Identity Verification pages returned a 404, meaning agent-friendly docs are not reliably available for this product area. missing for 10: a working IDV-specific llms.txt or markdown docs endpoint, evidence the MCP server exposes IDV-specific docs/tools, and independent confirmation of agent consumption.", "evidenceIds": [ "plaid-idv-probe-1", "plaid-idv-probe-2", "plaid-idv-probe-4" ] }, { "productId": "plaid-idv", "storyId": "agentic-ai-insights", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence shows Plaid IDV as a verification/workflow product with risk scores, dashboards, and webhooks, but nothing about AI-generated insights or suggestions surfaced to end users within the product itself; the MCP server reference is about agent connectivity, not in-product AI insights.", "evidenceIds": [ "plaid-idv-docs-11", "plaid-idv-probe-4" ] }, { "productId": "plaid-idv", "storyId": "agentic-autonomous-automation", "verdict": "partial", "quality": 5, "confidence": "low", "rationale": "Plaid IDV supports background automation via webhooks (STEP_UPDATED, STATUS_UPDATED, RETRIED) and a no-code Workflow Management editor that can run conditional verification checks without manual intervention, which enables some autonomous background processing. However, there is no evidence of AI-agent-specific automation setup, natural-language automation configuration, or scheduling/triggering by an AI agent itself. Missing for 10: explicit AI-agent-driven automation setup, natural-language workflow configuration, evidence of autonomous agent-triggered verification chains beyond webhook/workflow primitives.", "evidenceIds": [ "plaid-idv-docs-2", "plaid-idv-docs-3", "plaid-idv-docs-8", "plaid-idv-docs-5" ] }, { "productId": "plaid-idv", "storyId": "agentic-builtin-assistant", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Plaid Identity Verification is a backend identity-verification/KYC API and dashboard product, not an AI assistant or agentic interface; delegating tasks to a built-in AI assistant is a category error for this type of product. Evidence shows no-code workflow editor and dashboard tools, not any conversational/agentic assistant.", "evidenceIds": [ "plaid-idv-docs-8" ] }, { "productId": "plaid-idv", "storyId": "agentic-headless", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows Plaid IDV as an API/webhook-driven product with a no-code Dashboard editor and Sandbox testing inputs, but there is no documentation of a CLI, SDK automation, or CI-friendly headless workflow that an AI-native user could run in an automated pipeline. Missing for 10: explicit CI/headless usage docs, CLI or automation SDK evidence, example of scripted/unattended runs.", "evidenceIds": [ "plaid-idv-docs-8", "plaid-idv-docs-4", "plaid-idv-probe-3" ] }, { "productId": "plaid-idv", "storyId": "agentic-mcp-client", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Plaid Identity Verification is a verification/KYC SaaS API, not an AI agent or assistant that itself consumes external tools via MCP; the evidence shows Plaid offers an MCP server (docs/resources/mcp) exposing its own APIs, which is the reverse (server) role, not the client-side 'plug MCP servers in so it can use their tools' capability this story asks about. This axis is a category error for a non-agentic verification product.", "evidenceIds": [ "plaid-idv-probe-4" ] }, { "productId": "plaid-idv", "storyId": "agentic-mcp-server", "verdict": "full", "quality": 6, "confidence": "medium", "rationale": "Plaid is a platform/service (not itself an agent), so the axis applies, and evidence confirms an official MCP server exists at plaid.com/docs/resources/mcp/. However, the pack only shows the existence of the page, not details on what tools/capabilities are exposed via MCP or independent corroboration of its use. Missing for 10: documentation of specific MCP tool/resource definitions, usage examples, and independent/hands-on confirmation of successful agent connection.", "evidenceIds": [ "plaid-idv-probe-4" ] }, { "productId": "plaid-idv", "storyId": "agentic-nl-commands", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Plaid documents a no-code visual workflow editor for configuring Identity Verification, not natural-language command operation, but a probe confirms Plaid has an official MCP server (plaid.com/docs/resources/mcp/) which could allow AI agents to invoke Plaid APIs including IDV via natural language. There is no direct evidence that this MCP server specifically exposes Identity Verification actions or that end-users can operate IDV flows via NL commands. missing for 10: IDV-specific MCP tool documentation, examples of natural-language driven verification commands, independent confirmation of agentic usage.", "evidenceIds": [ "plaid-idv-probe-4", "plaid-idv-docs-8" ] }, { "productId": "plaid-idv", "storyId": "agentic-official-cli", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of an official CLI for Plaid Identity Verification; evidence only covers docs, dashboard, no-code editor, and an MCP server, none of which constitute a CLI tool.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "agentic-public-api", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Plaid IDV is documented as a REST API with webhooks, events, and workflow configuration, indicating a documented public API surface (plaid-idv-docs-1,2,3,5), and Plaid also publishes an official MCP server (plaid-idv-probe-4) supporting agentic access. However, an OpenAPI spec could not be located at standard paths and the docs-md probe 404'd, suggesting incomplete machine-readable API discoverability. missing for 10: publicly discoverable OpenAPI/schema spec, confirmation that MCP server covers IDV endpoints specifically, independent developer corroboration of API-driven automation.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-2", "plaid-idv-docs-3", "plaid-idv-docs-5", "plaid-idv-probe-3", "plaid-idv-probe-4" ] }, { "productId": "plaid-idv", "storyId": "agentic-scoped-keys", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "agentic-sdks", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Plaid provides official docs, webhooks, and an llms.txt for AI-native discovery, plus a documented official MCP server, but there's no direct evidence of official language-specific SDKs for Identity Verification itself (probes for OpenAPI spec and docs.md all 404). missing for 10: explicit official SDK references/links, independent developer corroboration of SDK usage.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-probe-1", "plaid-idv-probe-4", "plaid-idv-probe-2", "plaid-idv-probe-3" ] }, { "productId": "plaid-idv", "storyId": "agentic-webhooks", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Plaid IDV documents a clear webhook subscription mechanism with defined events (STEP_UPDATED, STATUS_UPDATED, RETRIED) that fire on verification progress, allowing programmatic/agentic subscription to state changes. Missing for 10: no explicit documentation of webhook payload schema, retry/delivery guarantees, or independent/hands-on confirmation that agentic systems actually consume these webhooks in production.", "evidenceIds": [ "plaid-idv-docs-3", "plaid-idv-docs-5" ] }, { "productId": "plaid-idv", "storyId": "aml-watchlist-screening", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Plaid's docs show that its separate Monitor product 'integrates directly with Identity Verification for an end-to-end verification and KYC solution,' implying sanctions/PEP/adverse-media screening is available from the same vendor, but the evidence never describes this as a single unified API call or review surface — it reads as two distinct products stitched together rather than one seamless verification session. Missing for 10: explicit documentation of sanctions/PEP/adverse-media screening as a native check within the IDV template/workflow itself, unified webhook/events covering watchlist results, and independent confirmation of a single review surface across both products.", "evidenceIds": [ "plaid-idv-docs-10", "plaid-idv-docs-2", "plaid-idv-docs-11" ] }, { "productId": "plaid-idv", "storyId": "api-interactive-docs", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of an interactive API reference with runnable examples; OpenAPI spec probes returned 404s and docs are plain markdown pages, not interactive/runnable explorer.", "evidenceIds": [ "plaid-idv-probe-3", "plaid-idv-probe-2" ] }, { "productId": "plaid-idv", "storyId": "api-machine-spec", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Probes explicitly show no OpenAPI/swagger spec found at any candidate path and no machine-readable .md/doc spec at the IDV docs endpoint; documentation is prose-based rather than a downloadable API spec.", "evidenceIds": [ "plaid-idv-probe-2", "plaid-idv-probe-3" ] }, { "productId": "plaid-idv", "storyId": "api-sandbox", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Plaid IDV documents a dedicated Sandbox mode with fixed test inputs to simulate successful/failed verification checks without touching production data, which directly supports safe testing. missing for 10: no independent/hands-on developer confirmation of sandbox fidelity, and no explicit mention of automated/agentic test workflows against the sandbox.", "evidenceIds": [ "plaid-idv-docs-4" ] }, { "productId": "plaid-idv", "storyId": "api-versioning-policy", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of API versioning scheme or documented deprecation policy for Plaid Identity Verification's APIs; docs cover verification features, webhooks, sandbox testing, but nothing on version lifecycle or deprecation commitments. The openapi.json probe also 404s, suggesting no discoverable machine-readable API spec that would typically accompany versioning docs.", "evidenceIds": [ "plaid-idv-probe-3", "plaid-idv-docs-3", "plaid-idv-docs-4" ] }, { "productId": "plaid-idv", "storyId": "automation-bulk-operations", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of batch/bulk API operations, bulk session creation, or programmatic multi-item processing for Identity Verification; documentation covers single-session workflows, webhooks, and dashboard-based overrides only, with no mention of bulk endpoints or automation-scale operations across many items.", "evidenceIds": [ "plaid-idv-docs-2", "plaid-idv-docs-3", "plaid-idv-docs-7" ] }, { "productId": "plaid-idv", "storyId": "automation-rules-engine", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Plaid IDV supports webhooks that fire on defined events (STEP_UPDATED, STATUS_UPDATED, RETRIED) and a Workflow Management editor that lets you run certain verification checks conditionally (e.g., only if another check fails or based on country), which together give a rule/event-driven automation capability. However, this is scoped to verification-flow logic and webhook notifications rather than a general-purpose 'define rules that trigger arbitrary actions' engine. missing for 10: evidence of a broader rule/action engine beyond conditional verification checks, and evidence of user-defined custom actions (not just webhook notifications) triggered by events.", "evidenceIds": [ "plaid-idv-docs-2", "plaid-idv-docs-3", "plaid-idv-docs-5", "plaid-idv-docs-8" ] }, { "productId": "plaid-idv", "storyId": "automation-scheduled-jobs", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Plaid Identity Verification is a KYC/identity verification API/dashboard product, not an automation or workflow-scheduling platform; scheduling recurring jobs is outside its category (webhooks for event-driven updates exist, but not user-initiated recurring job scheduling).", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "automation-versioned-workflows", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "This story concerns versioning/reviewing/rolling back AI-agent automations, which is not applicable to Plaid Identity Verification, an identity-verification API/workflow product for developers, not an AI automation builder.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "biometric-consent-compliance", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack contains only general product/API documentation (verification checks, webhooks, sandbox testing, dashboard features) with no mention of GDPR legal bases, BIPA or other biometric statutes, or required consent language for biometric data collection. Community items are off-topic sentiment about data trust, not legal compliance documentation.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "conversion-analytics", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Plaid documents a 'reporting' page defining conversion rate (session completion rate) and a Dashboard showing per-session risk scores, implying some analytics exist, but there is no evidence of drop-off-point analysis, completion-time metrics, or breakdowns by country or document type. missing for 10: drop-off funnel visualization, completion-time-by-country/document-type metrics, independent confirmation of dashboard analytics depth.", "evidenceIds": [ "plaid-idv-docs-6", "plaid-idv-docs-11" ] }, { "productId": "plaid-idv", "storyId": "data-retention-redaction", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers verification checks, webhooks, dashboards, and risk scoring, but contains no documentation of data retention windows or a redaction/deletion API for scrubbing PII on demand. The community comments express general distrust about data safety but do not concretely confirm or deny a deletion/retention mechanism, so they cannot be used to dispute the claim either way.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-11" ] }, { "productId": "plaid-idv", "storyId": "database-identity-checks", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Docs show IDV can check ID numbers, phone, address, name/DOB and combine checks conditionally (skipping some verifications like documents based on risk/country), implying some document-free paths exist, but no evidence explicitly names SSN, national registry, or credit-header-only verification flows as a distinct low-friction option. missing for 10: explicit mention of SSN-only or credit-header verification, explicit 'no-doc' database-only workflow example, independent confirmation of doc-free flows in production.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-2", "plaid-idv-docs-12" ] }, { "productId": "plaid-idv", "storyId": "deepfake-injection-defense", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack covers document verification, workflow management, webhooks, sandbox testing, risk scoring, and dashboard overrides, but contains no mention of liveness detection, anti-spoofing, deepfake detection, AI-generated face detection, or camera-injection defenses by name. Community items are off-topic (data trust/competition) and irrelevant to biometric liveness. Missing for 10: named liveness/anti-spoofing detection capabilities, deepfake or synthetic-face detection mentions, camera-injection attack defenses.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "global-document-coverage", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "Plaid's docs assert it verifies 'identification documents' and 'global ID documents' broadly, but no evidence provides an actual published list of supported countries or document types (passports, national IDs, driver licenses, residence permits) as the story requires. missing for 10: a published country/document-type coverage list, explicit mention of residence permits or other document categories, independent corroboration of coverage breadth.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-12", "plaid-idv-docs-2" ] }, { "productId": "plaid-idv", "storyId": "hosted-verification-flow", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs show a Link-based embeddable flow (onEvent updates), webhook events to read session status, and document/ID verification checks, indicating Plaid provides the capture UI and hosted/drop-in flow with server-driven session lifecycle. However, evidence never explicitly confirms a selfie/facial biometric step combined with document checks, nor explicitly describes server-side session creation API or a hosted redirect option (only Link embed and no-code editor are mentioned). Missing for 10: explicit selfie/liveness verification documentation, explicit server-side create-session API reference, and confirmation of a hosted (non-Link) redirect flow.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-5", "plaid-idv-docs-3", "plaid-idv-docs-12", "plaid-idv-docs-8" ] }, { "productId": "plaid-idv", "storyId": "kyb-business-verification", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "All evidence describes Plaid Identity Verification as a personal KYC flow (documents, phone, DOB, ID numbers, risk scoring) with no mention of business registry lookups, UBO identification, or a documented KYB workflow chaining into KYC on owners.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-2", "plaid-idv-docs-11", "plaid-idv-docs-10" ] }, { "productId": "plaid-idv", "storyId": "manual-review-queues", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm a Dashboard-based review path — failed verifications can be manually overridden and each session shows risk assessments and status updates via webhooks — implying some human-in-the-loop review, but there is no explicit description of a dedicated 'manual review queue' surfacing document images/extracted fields for borderline cases, nor documented mechanics for how reviewer decisions are recorded back into the verification record beyond a simple override click. missing for 10: explicit manual review queue UI, evidence bundling (docs+fields+checks) presented together for review, and documented reviewer-decision audit trail feeding back into the record.", "evidenceIds": [ "plaid-idv-docs-7", "plaid-idv-docs-11", "plaid-idv-docs-3", "plaid-idv-docs-6" ] }, { "productId": "plaid-idv", "storyId": "native-sdk-capture", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence confirms Plaid IDV supports document verification and has Link SDK flows with event callbacks (onEvent), but nothing describes native iOS/Android/web SDKs offering guided camera capture with glare, blur, or edge-detection coaching. Missing for 10: mention of native mobile SDKs, in-flow camera guidance features, and any glare/blur/edge detection capability documentation.", "evidenceIds": [ "plaid-idv-docs-5", "plaid-idv-docs-4" ] }, { "productId": "plaid-idv", "storyId": "no-code-verification-links", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "Plaid documents a no-code editor for building verification flows and a Dashboard for managing sessions, suggesting some non-engineering control, but there is no explicit evidence of an ops-facing feature to generate a shareable verification link or QR code for a one-off customer/contractor without engineering involvement. Missing for 10: explicit dashboard 'send link/QR code' feature, evidence of ops-only workflow without developer setup, and confirmation that Link integration isn't required for a single verification.", "evidenceIds": [ "plaid-idv-docs-8", "plaid-idv-docs-2" ] }, { "productId": "plaid-idv", "storyId": "ongoing-monitoring", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Plaid IDV's webhooks (STEP_UPDATED, STATUS_UPDATED, RETRIED) fire during a verification session's flow, not as ongoing re-screening of already-verified users against new watchlist hits. The docs explicitly point to a separate product, Plaid Monitor, for continuous monitoring/KYC, implying IDV itself does not perform continuous re-screening.", "evidenceIds": [ "plaid-idv-docs-3", "plaid-idv-docs-10" ] }, { "productId": "plaid-idv", "storyId": "openness-api-parity", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows several capabilities are explicitly UI/Dashboard-only — e.g., the no-code Workflow Management editor for creating flows (plaid-idv-docs-8) and overriding failed verifications 'via the Dashboard by clicking the Override Result button' (plaid-idv-docs-7) — with no documented API equivalent for either. There is no evidence of a full API surface mirroring these UI actions, so the story is not shown to be delivered.", "evidenceIds": [ "plaid-idv-docs-7", "plaid-idv-docs-8", "plaid-idv-probe-3" ] }, { "productId": "plaid-idv", "storyId": "openness-full-export", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of a user-facing data export/portability feature in open formats or account deletion/leave capability for Identity Verification data; evidence covers verification flows, webhooks, dashboard overrides, and risk scoring only.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "openness-open-license", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Plaid Identity Verification is a closed-source commercial SaaS API; open-sourcing product source code is not a plausible axis for this kind of product and no evidence suggests otherwise.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "openness-self-host", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Plaid Identity Verification is a hosted SaaS/API product with no self-hosted deployment option; self-hosting the core product is a category error for this type of cloud identity-verification service.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "phone-email-risk-signals", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm phone and email risk scoring plus granular risk assessments shown per session, and address/name/ID verification is documented as a check type, but there is no explicit documentation of carrier checks, address history checks, or device fingerprinting as distinct check types. missing for 10: explicit carrier check documentation, address history verification, device fingerprint/risk signal documentation.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-11" ] }, { "productId": "plaid-idv", "storyId": "privacy-data-residency", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack addresses data residency, regional storage options, or data localization controls for Identity Verification; the community citation reflects general distrust, not a data-residency dispute.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "privacy-no-training", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence of an AI-training opt-out or data-usage control for AI models; docs cover verification workflows, webhooks, and dashboard features only, and community comments express general distrust rather than confirming/denying such a control.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "privacy-retention-controls", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack contains no documentation of data retention settings, deletion APIs, or user-facing controls for purging identity verification data — only unrelated docs on verification checks, webhooks, and dashboard workflows. The negative community comment expresses general distrust but is not concrete evidence of a retention/deletion feature failing, so it doesn't support 'disputed'; it simply confirms no capability is evidenced.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-11", "plaid-idv-comm-1" ] }, { "productId": "plaid-idv", "storyId": "privacy-telemetry-optout", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack addresses telemetry/usage-tracking opt-out controls for Plaid Identity Verification; docs cover verification workflows, webhooks, and reporting but nothing about disabling analytics or usage data collection.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "repeat-fraud-detection", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence covers document/identity verification checks, risk scoring, webhooks, and dashboard overrides, but nothing describes cross-session duplicate or repeat-identity detection (e.g., matching the same face/document under different names). Missing for 10: any documentation of duplicate-identity or repeat-fraud detection across sessions, biometric/face matching against prior submissions, or deduplication reporting.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-11", "plaid-idv-docs-6" ] }, { "productId": "plaid-idv", "storyId": "reusable-verifications", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack covers verification checks, workflows, webhooks, sandbox testing, and dashboard overrides, but nowhere documents a mechanism to recognize a previously verified user and reuse a passed check across sessions or products instead of re-running verification.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "sandbox-test-verifications", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Plaid's docs explicitly document a Sandbox mode with a fixed set of inputs that deterministically produce specific Data Source and Documentary Verification check outcomes, directly matching the story's requirement for documented test values to exercise pass/fail scenarios. Missing for 10: explicit confirmation of a 'review' outcome test value and independent/hands-on developer corroboration beyond first-party docs.", "evidenceIds": [ "plaid-idv-docs-4" ] }, { "productId": "plaid-idv", "storyId": "selfie-match-liveness", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers document verification, workflows, webhooks, sandbox testing, risk scoring, and dashboard overrides, but never mentions selfie/facial matching or liveness detection defenses against photos, screens, or replayed video. No documentation cites a selfie check or anti-spoofing mechanism at all.", "evidenceIds": [] }, { "productId": "plaid-idv", "storyId": "session-lifecycle-api", "verdict": "partial", "quality": 4, "confidence": "medium", "rationale": "Docs confirm session lifecycle events (webhooks for STEP_UPDATED/STATUS_UPDATED/RETRIED) and sandbox testing, implying some API-driven flow, but there is no explicit documentation of endpoints for creating a session, fetching status/results, retrieving captured media, or canceling/redacting a session via API — most control (overrides, flow editing) is shown as Dashboard/no-code actions rather than API calls. missing for 10: explicit API reference for create/get/retrieve-media/cancel/redact endpoints, first-party API examples for each lifecycle step.", "evidenceIds": [ "plaid-idv-docs-3", "plaid-idv-docs-4", "plaid-idv-docs-7", "plaid-idv-docs-8" ] }, { "productId": "plaid-idv", "storyId": "structured-data-extraction", "verdict": "partial", "quality": 5, "confidence": "low", "rationale": "Docs confirm Plaid extracts and verifies fields like name, DOB, ID numbers, and address from documents, and risk scores/results are viewable in the Dashboard, implying this data exists per session. However, there's no explicit evidence that these individual extracted document fields are retrievable via API as structured data in the response payload (as opposed to just Dashboard viewing or an overall pass/fail status). Missing for 10: explicit API schema/response example showing per-field structured output (name, DOB, document number, address, expiry) retrievable via API call, independent developer confirmation of this data access pattern.", "evidenceIds": [ "plaid-idv-docs-1", "plaid-idv-docs-11", "plaid-idv-docs-12" ] }, { "productId": "plaid-idv", "storyId": "verification-webhooks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Plaid IDV documents webhook events (STEP_UPDATED, STATUS_UPDATED, RETRIED) that let a developer react to verification lifecycle changes without polling, but the evidence never confirms these webhooks are cryptographically signed nor does it list the specific status values (created, processing, verified, requires-input) named in the story. Missing for 10: explicit documentation of webhook signature verification, and confirmation of the exact lifecycle status enum matching the story's terms.", "evidenceIds": [ "plaid-idv-docs-3", "plaid-idv-docs-5" ] }, { "productId": "plaid-idv", "storyId": "workflow-rules-routing", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Plaid's docs explicitly describe a no-code Workflow Management editor for building templates, combining conditional checks (run only if another fails or is high-risk), and country-based routing, plus a dashboard for overrides and risk scoring—matching the ops-lead story closely. missing for 10: independent/hands-on validation of the no-code editor's actual usability and confirmation that template changes deploy without any engineering involvement in practice.", "evidenceIds": [ "plaid-idv-docs-2", "plaid-idv-docs-8", "plaid-idv-docs-11", "plaid-idv-docs-7" ] }, { "productId": "stripe-identity", "storyId": "agent-onboarding-decisions", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Stripe Identity's API returns structured verification_sessions objects with programmatic access to results, extracted data, and outcome webhooks that trigger automated reactions, giving an onboarding flow machine-readable data to branch on (docs-5, docs-6, docs-7, docs-4). Failure reasons and status overrides are documented via review tools, but there's no explicit schema showing granular risk-signal taxonomies or agent-specific decision guidance, and community reports (comm-12, comm-13) show ambiguous 'document invalid' failures that complicate automated branching. missing for 10: a documented enumerated list/schema of all risk signals and failure reason codes, independent confirmation that failure reasons are granular/actionable enough for automated branching rather than opaque.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-4", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-comm-12", "stripe-identity-comm-13" ] }, { "productId": "stripe-identity", "storyId": "agent-runs-verification", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Stripe Identity's API supports creating verification sessions, listening for/polling outcomes via webhooks, and retrieving extracted data programmatically with a scoped secret key, and Stripe has a general MCP server that exposes Stripe API tools to agents. However, there is no evidence the MCP server specifically exposes Identity operations (session creation, outcome polling, data retrieval, re-checks) or documents scoped credentials for Identity use cases, nor any agent-specific workflow example. missing for 10: MCP tool listing/documentation confirming Identity-specific endpoints are exposed, evidence of scoped/restricted API keys for agent use, and confirmation of a re-check/retry trigger via API or MCP.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-12", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-agent-docs", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Stripe's docs.stripe.com serves both an llms.txt (200) and .md variants of Identity docs (200), confirmed via direct probes, letting an agent be pointed at machine-readable docs. Missing for 10: no explicit agent-oriented guidance specific to Identity beyond the generic llms.txt, and no independent community confirmation of agents successfully using it this way.", "evidenceIds": [ "stripe-identity-probe-1", "stripe-identity-probe-2", "stripe-identity-docs-2" ] }, { "productId": "stripe-identity", "storyId": "agentic-ai-insights", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "No evidence that Stripe Identity itself generates AI-driven insights or suggestions from verification data; the docs describe verification, review tools, and manual override, not AI-generated analytics or recommendations. The MCP server reference is about external agents calling Stripe's API, not in-product AI insights for the user.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "agentic-autonomous-automation", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Stripe Identity supports webhook-driven automation (auto-triggering reactions to verification outcomes, programmatic access, blocklist automation) and Stripe now ships an official MCP server letting AI agents call the API, which together enable background/autonomous workflows. However, evidence doesn't show any AI-native scheduling, agent orchestration, or first-party 'set-and-forget' automation framework specific to Identity beyond webhooks+MCP. Missing for 10: dedicated agent/automation tooling within Identity itself, independent hands-on confirmation of autonomous agent use via MCP for identity verification, and detail on how persistent/background jobs are managed.", "evidenceIds": [ "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-docs-12", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-builtin-assistant", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is an identity-verification API/product, not an AI assistant application; there is no evidence of a built-in AI assistant users can delegate tasks to (the MCP server evidence is for external agents connecting to Stripe, not a built-in assistant within the product).", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "agentic-headless", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Stripe Identity exposes a full REST API (curl examples for creating verification sessions), webhooks for automated result handling, and programmatic access to results, which supports headless/CI-style automation. However, there's no evidence of a dedicated SDK/test-mode designed for CI pipelines, official CI examples, or automated testing harnesses specific to Identity verification flows. missing for 10: CI-specific tooling/examples, automated test-mode documentation for Identity, independent hands-on confirmation of headless CI usage.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-9" ] }, { "productId": "stripe-identity", "storyId": "agentic-mcp-client", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is an identity-verification API/service, not an agent or agent-hosting platform that consumes external tools; the evidence only shows Stripe providing an MCP *server* for other AI agents to call Stripe's API (the reverse role), not Stripe Identity acting as an MCP client that plugs in third-party MCP servers.", "evidenceIds": [ "stripe-identity-docs-12", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-mcp-server", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Stripe (the platform Stripe Identity belongs to) has an official documented MCP server that lets AI agents interact with 'the Stripe API,' confirmed by both docs and a probe. However, the evidence never explicitly confirms that Identity-specific verification-session endpoints are exposed as MCP tools, leaving a gap in scope specificity. Missing for 10: explicit documentation or example showing Identity verification-session/session-result operations available as MCP tools, and independent/community confirmation of using the MCP server for Identity use cases.", "evidenceIds": [ "stripe-identity-docs-12", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-nl-commands", "verdict": "partial", "quality": 5, "confidence": "low", "rationale": "Stripe provides an official MCP server that lets AI agents interact with the Stripe API via natural-language-driven tool calls, which would in principle expose Identity operations (create/verify sessions, review) to an AI agent. However, there is no evidence specifically confirming Identity endpoints are exposed through this MCP server, nor any hands-on or community confirmation of natural-language operation of Identity itself. Missing for 10: explicit documentation that Identity API/actions are covered by the MCP server, and independent/hands-on evidence of an AI agent successfully running Identity verification via natural-language commands.", "evidenceIds": [ "stripe-identity-docs-12", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-official-cli", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Stripe offers an official Stripe CLI documented at docs.stripe.com/stripe-cli, which applies platform-wide including Identity API interactions, though evidence doesn't show Identity-specific CLI commands or AI-native workflow integration beyond the generic CLI listing. missing for 10: Identity-specific CLI usage examples, independent hands-on confirmation of CLI use with Identity endpoints, agentic/AI-native workflow documentation for the CLI.", "evidenceIds": [ "stripe-identity-probe-5" ] }, { "productId": "stripe-identity", "storyId": "agentic-public-api", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Stripe Identity exposes a documented REST API (verification_sessions endpoint with curl examples), webhooks for outcomes, programmatic access to verification results, and review/blocklist actions — all usable to fully drive the product without a UI. There's also an official MCP server for AI agents to interact with the Stripe API. Missing for 10: a public OpenAPI/swagger spec was probed and returned 404s, and no independent hands-on report of an AI agent driving the API end-to-end.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-docs-12", "stripe-identity-probe-3", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-scoped-keys", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "agentic-sdks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs show a well-documented REST API (curl examples, programmatic access to verification results, webhooks) and even an official MCP server for AI agents, implying SDK-friendly integration, but no evidence explicitly documents official client SDKs (e.g., Node/Python/Ruby libraries) or their AI/agentic usage patterns. missing for 10: explicit official SDK documentation, language-specific SDK usage examples, and any AI-native tooling built directly on those SDKs beyond the generic MCP server mention.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-12", "stripe-identity-probe-3", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "agentic-webhooks", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Stripe Identity's docs explicitly describe listening for verification results via webhooks/events to trigger automated reactions, and events/webhooks are Stripe's standard integration mechanism supported across products including Identity. Missing for 10: explicit webhook event-type list for Identity, independent hands-on confirmation of webhook reliability/latency, and AI-agent-specific webhook subscription tooling beyond general docs.", "evidenceIds": [ "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-4" ] }, { "productId": "stripe-identity", "storyId": "aml-watchlist-screening", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence covers ID document verification, selfie matching, SSN validation, and review/override tools, but no mention of sanctions, PEP, or adverse-media watchlist screening anywhere in docs or community reports.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "api-interactive-docs", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Docs include concrete code samples (e.g., curl requests for verification sessions) and structured API reference pages, but there is no evidence of an interactive, runnable API console (probes show openapi.json/swagger.json 404, and no mention of a 'try it' sandbox or live code execution). missing for 10: evidence of an in-browser runnable/interactive API explorer, discoverable OpenAPI spec, or independent confirmation of interactivity.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-7", "stripe-identity-probe-2", "stripe-identity-probe-3" ] }, { "productId": "stripe-identity", "storyId": "api-machine-spec", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack shows an explicit probe for OpenAPI/swagger spec files at standard paths, all returning 404, and no docs page or claim points to a downloadable machine-readable API spec for Identity; only human-readable curl examples and prose docs exist.", "evidenceIds": [ "stripe-identity-probe-3", "stripe-identity-docs-5" ] }, { "productId": "stripe-identity", "storyId": "api-sandbox", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence in the pack mentions a sandbox, test mode, or test API keys specific to Stripe Identity that would let a developer verify documents without touching production data. Missing for 10: any documentation of Identity test-mode verification sessions, sandbox test IDs/selfies, or explicit test/live key separation for this product.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "api-versioning-policy", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "Evidence shows API usage (curl examples, secret key access) but no documentation of API versioning scheme or a deprecation policy; the OpenAPI probe returned 404s, and no changelog/versioning docs are cited. Missing for 10: versioning scheme docs, deprecation policy docs, changelog/migration guides.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-probe-3" ] }, { "productId": "stripe-identity", "storyId": "automation-bulk-operations", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows only per-session API calls (create one verification_session at a time) and no batch/bulk endpoint for processing many verifications in a single call; the 'static link' flow (docs-9) supports many users sequentially, not bulk operations in an AI-native automation sense. No documentation of bulk create/list/export or batch-processing APIs is present.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-9" ] }, { "productId": "stripe-identity", "storyId": "automation-rules-engine", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Stripe Identity supports event-driven automation via webhooks ('Listen for verification results so your integration can automatically trigger reactions') and has some built-in rule-like actions (auto-blocklisting matched documents, override status), but there's no evidence of a user-facing rules engine where an AI-native user can declaratively define custom conditional rules — automation still requires the developer to write webhook-handling code. Missing for 10: a declarative rules/conditions builder, evidence of AI-agent-configurable triggers beyond generic webhooks, and confirmation the MCP server exposes rule-definition capabilities.", "evidenceIds": [ "stripe-identity-docs-6", "stripe-identity-docs-11", "stripe-identity-docs-10", "stripe-identity-docs-12" ] }, { "productId": "stripe-identity", "storyId": "automation-scheduled-jobs", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is a point-in-time identity verification API (document capture, verification sessions, webhooks for outcomes) — it is not a workflow orchestration or job-scheduling product, so 'scheduling recurring jobs/workflows' is a category error rather than a missing feature.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "automation-versioned-workflows", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is an identity-verification API/service; it has no concept of 'automations' that a user builds, versions, reviews, or rolls back — that's a workflow/automation-builder axis, not applicable to this product category.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "biometric-consent-compliance", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "None of the docs or community evidence address legal bases for biometric processing (GDPR Art. 9 basis, BIPA compliance, consent language) — evidence covers technical integration, review tools, and pricing/UX feedback only. missing for 10: GDPR legal basis documentation, BIPA/state biometric statute compliance statements, sample consent language, any privacy/legal compliance whitepaper.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "conversion-analytics", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence covers verification session creation, review tools, and access to individual verification results, but nothing about aggregate funnel analytics (pass rates, drop-off points, completion time breakdowns by country/document type) that a founder could use to quantify signup cost. Missing for 10: dashboard/analytics UI for funnel metrics, aggregated pass-rate or drop-off reporting, completion-time-by-country/doc-type breakdowns.", "evidenceIds": [ "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-10" ] }, { "productId": "stripe-identity", "storyId": "data-retention-redaction", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack shows verification, review tools (override/blocklist), and access to collected data, but contains no documentation of retention windows or a redaction/deletion API for scrubbing PII on demand. Community commentary even raises concerns about long-term data storage trust without any documented deletion mechanism countering it.", "evidenceIds": [ "stripe-identity-docs-4", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-comm-8" ] }, { "productId": "stripe-identity", "storyId": "database-identity-checks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm SSN validation as part of document verification flow (stripe-identity-docs-3), but evidence is thin on standalone no-document checks like national registry lookups or credit-header/database-only verification — SSN validation appears bundled with document capture rather than a document-free flow. Missing for 10: explicit documented database-only/no-document verification session type, national registry checks, credit-header data verification, and independent confirmation these work without a doc scan.", "evidenceIds": [ "stripe-identity-docs-3", "stripe-identity-docs-2", "stripe-identity-docs-5" ] }, { "productId": "stripe-identity", "storyId": "deepfake-injection-defense", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack only shows generic mentions of ID/selfie matching and fraud prevention (e.g., 'match documents to selfies... to prevent fraud') but no named detection capabilities against AI-generated faces, deepfakes, or camera-injection attacks. No documentation specifically addresses liveness detection technology or anti-spoofing mechanisms by name.", "evidenceIds": [ "stripe-identity-docs-3", "stripe-identity-probe-2" ] }, { "productId": "stripe-identity", "storyId": "global-document-coverage", "verdict": "disputed", "quality": 5, "confidence": "medium", "rationale": "Stripe's docs claim ID verification for 120+ countries and mention passports, national IDs, and other government-issued photo IDs, but there's no published document-type breakdown (passport vs. national ID vs. driver license vs. residence permit) per country, and community reports concretely contradict full breadth: a user notes Polish IDs are unsupported despite smaller countries being covered, and multiple reports describe Chinese passports being rejected as 'invalid' during verification. missing for 10: a published per-country/per-document-type coverage list, and resolution of documented failures for specific document types (e.g., Chinese passports, Polish IDs).", "evidenceIds": [ "stripe-identity-docs-1", "stripe-identity-docs-2", "stripe-identity-comm-6", "stripe-identity-comm-12", "stripe-identity-comm-13" ] }, { "productId": "stripe-identity", "storyId": "hosted-verification-flow", "verdict": "full", "quality": 7, "confidence": "high", "rationale": "Docs show server-side session creation via API (docs-5), a hosted, conversion-optimized capture flow with no custom UI needed (docs-2, docs-1, docs-3), and mechanisms to read results via webhooks or API (docs-6, docs-7), plus reusable 'Flows' for static links (docs-8, docs-9). Community hands-on reports corroborate the redirect-based hosted UX working well across desktop/mobile with no native app needed (stripe-identity-comm-2, stripe-identity-comm-5). Missing for 10: explicit documentation of an embeddable/drop-in JS element (vs. only hosted redirect) and independent verification of the full create→redirect→read loop end-to-end.", "evidenceIds": [ "stripe-identity-docs-1", "stripe-identity-docs-2", "stripe-identity-docs-3", "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-8", "stripe-identity-docs-9", "stripe-identity-comm-2", "stripe-identity-comm-5" ] }, { "productId": "stripe-identity", "storyId": "kyb-business-verification", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Stripe Identity documentation and community evidence focus entirely on individual identity verification (ID documents, selfie matching, SSN validation) — nothing addresses business registry lookups, UBO identification, or KYB flows chaining into KYC on owners.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "manual-review-queues", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm access to full evidence (images, extracted fields, check results) via API and review tools that let a human override status or blocklist a document, which supports manual review workflows, but there's no documented dedicated 'manual review queue' UI for borderline cases, no explicit routing/escalation logic for borderline verifications, and no evidence that reviewer decisions are captured as structured feedback beyond a status override. missing for 10: a native queue/dashboard for borderline cases, explicit borderline-detection/escalation criteria, and structured reviewer-decision feedback loop into the verification record.", "evidenceIds": [ "stripe-identity-docs-4", "stripe-identity-docs-7", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-docs-6" ] }, { "productId": "stripe-identity", "storyId": "native-sdk-capture", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence only references a generic 'conversion-optimized verification flow' and one community comment describing browser-based (not native) image capture across desktop/phone; there is no documentation of native iOS/Android SDKs or of glare, blur, or edge-detection coaching during capture.", "evidenceIds": [ "stripe-identity-docs-2", "stripe-identity-comm-2" ] }, { "productId": "stripe-identity", "storyId": "no-code-verification-links", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Stripe Identity's \"Flows\" feature explicitly supports a static, shareable link that ops can send to verify any number of users without engineering integration work (stripe-identity-docs-8, stripe-identity-docs-9), fitting the no-code link use case; community evidence confirms the flow is simple enough for non-technical guests to complete via a link on mobile (stripe-identity-comm-2, stripe-identity-comm-5). Missing for 10: explicit mention of QR code generation/sharing, and independent hands-on confirmation of the ops/no-ticket workflow specifically (vs. general link UX).", "evidenceIds": [ "stripe-identity-docs-8", "stripe-identity-docs-9", "stripe-identity-comm-2", "stripe-identity-comm-5" ] }, { "productId": "stripe-identity", "storyId": "ongoing-monitoring", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Stripe Identity's evidence covers one-time document verification, selfie matching, SSN validation, and webhook-based verification-session outcomes, but there is no mention of watchlist/sanctions screening or continuous re-screening of previously verified users against watchlist updates. This is a plausible axis for an identity-verification product (competitors like Persona/Onfido offer ongoing AML monitoring), so absence of evidence yields 'none' rather than 'na'.", "evidenceIds": [ "stripe-identity-docs-3", "stripe-identity-docs-6", "stripe-identity-docs-7" ] }, { "productId": "stripe-identity", "storyId": "openness-api-parity", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Core verification workflow (create sessions, retrieve results, webhooks) is fully documented via REST API (stripe-identity-docs-5,6,7), and even AI agents can invoke it via the official MCP server (stripe-identity-docs-12, stripe-identity-probe-4). However, review-tool actions like manually overriding verification status or blocklisting documents (stripe-identity-docs-10,11) are described in the context of the dashboard review UI with no confirmed API endpoint, and 'Flows' configuration (stripe-identity-docs-8,9) also appears to be a dashboard-centric concept without clear API-driven equivalent. Missing for 10: documented API endpoints for manual status override/blocklist actions, API-based flow configuration, and independent confirmation that all dashboard actions have API parity.", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-docs-8", "stripe-identity-docs-12", "stripe-identity-probe-4" ] }, { "productId": "stripe-identity", "storyId": "openness-full-export", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is a KYC/identity-verification API for businesses, not a personal data platform; end users have no account or export mechanism, and evidence shows only programmatic access by the integrating business (via API/secret key), not data export/portability for the verified individual to leave with their data in open formats. No evidence of any data-export or account-closure/data-portability feature for the AI-native end user persona.", "evidenceIds": [ "stripe-identity-docs-7", "stripe-identity-docs-4" ] }, { "productId": "stripe-identity", "storyId": "openness-open-license", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is a closed proprietary SaaS API/service, not open-source software; source-code openness is not a fair axis for this kind of product's evidence pack.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "openness-self-host", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Stripe Identity is a hosted SaaS verification API; self-hosting the core product is not a coherent axis for this kind of managed cloud service.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "phone-email-risk-signals", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence shows Stripe Identity supports document verification, selfie matching, and SSN validation, but nothing documents carrier/phone risk checks, address history checks, or device fingerprinting as check types.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "privacy-data-residency", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "No evidence of any data residency/region-selection controls for Stripe Identity; docs and community discussion focus on verification flows, pricing, and document support, with no mention of choosing storage region or data residency options.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "privacy-no-training", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence pack content addresses AI-model-training data usage, opt-out controls, or any privacy policy specific to AI training exclusion for Stripe Identity; the evidence only covers identity verification features, pricing, and integration mechanics.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "privacy-retention-controls", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers verification flows, review tools, and access to results, but contains no documentation of data retention policies, deletion controls, or user-initiated data removal/export mechanisms for AI-native or any users. Community commentary raises concern about data security/trust (comm-8) but does not confirm any retention/deletion controls exist. Missing for 10: any documentation of retention periods, deletion APIs/endpoints, data export or right-to-erasure workflows, or AI-agent-specific controls over stored ID data.", "evidenceIds": [ "stripe-identity-comm-8" ] }, { "productId": "stripe-identity", "storyId": "privacy-telemetry-optout", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "No evidence in the pack mentions telemetry opt-out, usage tracking controls, or any privacy settings for AI-native usage; Stripe Identity is an identity verification API and the evidence is entirely about document verification and KYC features, not telemetry controls.", "evidenceIds": [] }, { "productId": "stripe-identity", "storyId": "repeat-fraud-detection", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "Docs mention a manual 'add to blocklist' review tool that can block future verifications using the same flagged document, but this requires an analyst to manually add the document rather than the platform automatically detecting and flagging duplicate faces/documents resurfacing under different names. There's no evidence of automatic cross-session biometric or document matching for fraud rings. Missing for 10: automatic duplicate/repeat-identity detection across sessions, face-matching across different names, proactive fraud-ring flagging without manual analyst action.", "evidenceIds": [ "stripe-identity-docs-11", "stripe-identity-docs-10" ] }, { "productId": "stripe-identity", "storyId": "reusable-verifications", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Docs describe verification flows, blocklisting bad documents, and manual overrides, but there is no documented mechanism to recognize a previously-verified person and reuse their passed check to skip a new verification session across products/sessions. missing for 10: explicit reuse/verification-caching API, cross-session identity linking, documentation of skipping re-verification for a known verified user.", "evidenceIds": [ "stripe-identity-docs-8", "stripe-identity-docs-9", "stripe-identity-docs-10", "stripe-identity-docs-11" ] }, { "productId": "stripe-identity", "storyId": "sandbox-test-verifications", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of documented test/sandbox mode, magic values, or deterministic test personas for triggering pass/fail/review outcomes in Stripe Identity's docs; evidence only covers live verification flow, review tools, and API access, with community complaints about real-world verification failures (not sandbox testing).", "evidenceIds": [ "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-10", "stripe-identity-comm-12", "stripe-identity-comm-13" ] }, { "productId": "stripe-identity", "storyId": "selfie-match-liveness", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Docs confirm selfie-to-document matching as part of the verification flow (stripe-identity-docs-3, stripe-identity-probe-2), but there is no documented mention of liveness detection or specific anti-spoofing defenses against printed photos, screens, or replayed video. Missing for 10: explicit liveness detection documentation, anti-spoofing technical details, and independent/hands-on evidence that liveness checks defeat photo/screen/video replay attacks.", "evidenceIds": [ "stripe-identity-docs-3", "stripe-identity-probe-2" ] }, { "productId": "stripe-identity", "storyId": "session-lifecycle-api", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs cover creating a session via API (docs-5), listening for status/results (docs-6, docs-7), and accessing captured images/data (docs-4), plus review tools like manual override and blocklisting (docs-10, docs-11). However, no evidence in the pack documents the cancel or redact endpoints for verification sessions, which are explicit parts of the story. missing for 10: documented cancel session endpoint, documented redact endpoint, and independent confirmation of full lifecycle API coverage.", "evidenceIds": [ "stripe-identity-docs-4", "stripe-identity-docs-5", "stripe-identity-docs-6", "stripe-identity-docs-7", "stripe-identity-docs-10", "stripe-identity-docs-11" ] }, { "productId": "stripe-identity", "storyId": "structured-data-extraction", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Docs explicitly state you can access collected images and extracted data from ID documents programmatically via secret key, and the API returns structured verification details rather than a simple flag; the verification_sessions API and access-verification-results docs support this. Missing for 10: an explicit enumerated field list (name, DOB, document number, address, expiry) in the evidence pack and independent hands-on confirmation of exact field names.", "evidenceIds": [ "stripe-identity-docs-4", "stripe-identity-docs-7", "stripe-identity-docs-5", "stripe-identity-docs-6" ] }, { "productId": "stripe-identity", "storyId": "verification-webhooks", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Docs confirm Identity supports webhook-based outcome handling (\"Listen for verification results so your integration can automatically trigger reactions\") and programmatic access to verification results, satisfying the no-polling reaction pattern. However, the pack never shows signature verification details or explicitly enumerates the created/processing/verified/requires-input event lifecycle. Missing for 10: explicit webhook signing/verification documentation, enumerated event-type list, and independent/hands-on confirmation of the full lifecycle firing correctly.", "evidenceIds": [ "stripe-identity-docs-6", "stripe-identity-docs-7" ] }, { "productId": "stripe-identity", "storyId": "workflow-rules-routing", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "Stripe Identity offers 'Flows' to save and reuse a verification configuration across integration surfaces without redeploying code, and review tools let ops manually override statuses or blocklist documents, but there is no evidence of a no-code UI for conditional branching, risk-based routing, or country-specific rule sets — most configuration (document types, session creation) still happens via API calls in docs examples. missing for 10: no-code conditional-step builder, risk-based routing rules, country-specific requirement configuration, and independent confirmation that Flows support these beyond simple reuse.", "evidenceIds": [ "stripe-identity-docs-8", "stripe-identity-docs-9", "stripe-identity-docs-10", "stripe-identity-docs-11", "stripe-identity-comm-15" ] }, { "productId": "sumsub", "storyId": "agent-onboarding-decisions", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Sumsub's REST API and webhook system (sumsub-docs-1, sumsub-docs-3) provide machine-readable verification events, and verification levels/AML screening (sumsub-docs-5, sumsub-docs-6) imply structured check results and risk categorization that an automated flow could branch on; the MCP server (sumsub-docs-4, sumsub-probe-3) further supports agent-driven access. However, the evidence never shows the actual JSON schema, specific risk-score fields, or enumerated failure-reason codes, and no OpenAPI spec is discoverable (sumsub-probe-2), so it's unclear how granular/structured the failure reasons truly are. Missing for 10: explicit schema/examples of check-result payloads, documented risk-signal taxonomy, and enumerated failure-reason codes for automated branching.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-3", "sumsub-docs-5", "sumsub-docs-6", "sumsub-docs-4", "sumsub-probe-3", "sumsub-probe-2" ] }, { "productId": "sumsub", "storyId": "agent-runs-verification", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Sumsub has a documented REST API and an official MCP server explicitly described for letting AI agents perform Sumsub operations under scoped role-based permissions (sumsub-docs-4, sumsub-probe-3), plus webhooks for outcome notification (sumsub-docs-3). However, evidence doesn't confirm specifics like polling outcomes, retrieving extracted data, or triggering re-checks explicitly through the MCP surface, nor is there an OpenAPI spec confirming full API surface (sumsub-probe-2 shows 404s). Missing for 10: explicit documentation of session creation/polling/re-check operations via MCP, confirmation of scoped credential granularity within MCP, and independent/hands-on validation of the MCP server's agent workflows.", "evidenceIds": [ "sumsub-docs-4", "sumsub-probe-3", "sumsub-docs-3", "sumsub-docs-1", "sumsub-probe-2" ] }, { "productId": "sumsub", "storyId": "agentic-agent-docs", "verdict": "full", "quality": 9, "confidence": "high", "rationale": "A live probe confirms llms.txt exists at docs.sumsub.com/llms.txt (HTTP 200) with explicit guidance that any doc page can be appended with .md for markdown, and docs pages are indeed served as .md variants throughout the evidence pack, directly enabling agent-oriented consumption. Missing for 10: no independent third-party confirmation of an agent actually consuming this successfully.", "evidenceIds": [ "sumsub-probe-1", "sumsub-docs-7", "sumsub-docs-8", "sumsub-docs-9" ] }, { "productId": "sumsub", "storyId": "agentic-ai-insights", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers AI-driven verification checks (liveness, document verification, AML screening) and an MCP server for agents to perform actions, but there is no evidence of AI-generated insights, summaries, or suggestions surfaced to users from their own data inside the product dashboard. missing for 10: any documented AI-generated analytics/insights feature, dashboard summarization, or recommendation engine within the Sumsub UI.", "evidenceIds": [ "sumsub-docs-6", "sumsub-docs-12", "sumsub-docs-4" ] }, { "productId": "sumsub", "storyId": "agentic-autonomous-automation", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub supports background automation implicitly via webhooks (automatic event notifications), verification levels (automated multi-step verification sequences), and AML screening configuration that runs automatically — plus an MCP server letting AI agents perform operations autonomously under role permissions. However, there's no dedicated workflow/rules builder or scheduler described as enabling arbitrary user-defined 'set and forget' automations beyond the verification pipeline itself. Missing for 10: an explicit automation/workflow orchestration feature, scheduling capability, and independent evidence of autonomous background runs beyond webhook triggers.", "evidenceIds": [ "sumsub-docs-3", "sumsub-docs-5", "sumsub-docs-6", "sumsub-docs-4", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-builtin-assistant", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence only shows an MCP server that lets external AI agents call Sumsub operations, which is the reverse of a built-in AI assistant that users delegate tasks to inside the product. No evidence of an in-product AI assistant/copilot for end users.", "evidenceIds": [ "sumsub-docs-4", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-headless", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Sumsub exposes a RESTful API, sandbox mode for testing integrations, and webhooks for event-driven automation—these together enable headless/CI-style usage without a UI. However, there is no explicit CI/CD tooling, CLI, or documented automation pipeline examples confirming actual CI usage. missing for 10: explicit CI/CD integration examples, official CLI, automated test/build pipeline documentation.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-2", "sumsub-docs-3" ] }, { "productId": "sumsub", "storyId": "agentic-mcp-client", "verdict": "na", "quality": 0, "confidence": "medium", "rationale": "Sumsub is a KYC/verification SaaS platform, not an AI agent or assistant runtime; the evidence only shows Sumsub exposing its own MCP server for other agents to consume (docs-4, probe-3), which is the reverse role from 'plugging MCP servers into this product.' There is no agentic client capability in Sumsub itself that could consume external MCP servers, making this axis a category error for this product type.", "evidenceIds": [ "sumsub-docs-4", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-mcp-server", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Sumsub explicitly documents an official MCP server that lets AI agents perform Sumsub operations under existing role permissions, corroborated by a probe confirming the doc page exists. missing for 10: independent/hands-on third-party confirmation of the MCP server working in practice, and details on setup/authentication scope.", "evidenceIds": [ "sumsub-docs-4", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-nl-commands", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Sumsub documents an official MCP server that lets AI agents perform Sumsub operations on the user's behalf under role-based permissions, which enables natural-language/agentic control via an AI agent interface rather than the product itself exposing an NL command layer. Missing for 10: direct evidence of a native natural-language command interface within Sumsub's own UI/API, and independent/hands-on confirmation of the MCP server's real-world usability.", "evidenceIds": [ "sumsub-docs-4", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-official-cli", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "agentic-public-api", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Sumsub documents a public RESTful API for verification workflows, webhooks for events, sandbox testing, and even an official MCP server enabling AI agents to perform operations via the API. This directly satisfies the AI-native driving-via-API story. Missing for 10: a discoverable formal OpenAPI/Swagger spec (probe found 404s), and independent third-party corroboration of API usage.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-2", "sumsub-docs-3", "sumsub-docs-4", "sumsub-probe-2", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-scoped-keys", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub's MCP server docs state that AI agent access is controlled by existing Sumsub role permissions, implying some scoping via role-based access control, and separate docs confirm team member access management exists. However, there's no explicit documentation of issuing distinct, least-privilege API credentials/tokens scoped specifically to an agent (e.g., token-level scopes, expiring keys, or granular per-agent permission sets). Missing for 10: dedicated API-key/token scoping mechanism, documented permission granularity for agent-specific credentials, and independent confirmation of least-privilege enforcement in practice.", "evidenceIds": [ "sumsub-docs-4", "sumsub-docs-8", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-sdks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm Web and Mobile SDKs plus a RESTful API and sandbox for integration testing, and even an MCP server for agentic use, but there is no evidence of broader official language SDKs (e.g., server-side Python/Node/Java), GitHub repos, or independent developer corroboration. missing for 10: list of official server-side/language SDKs, GitHub repo links, independent developer confirmation of SDK quality.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-2", "sumsub-docs-7", "sumsub-docs-4", "sumsub-probe-3" ] }, { "productId": "sumsub", "storyId": "agentic-webhooks", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Sumsub's documented Webhooks feature explicitly allows automatic subscription to applicant verification events and status changes, directly matching the story. Missing for 10: independent/hands-on corroboration of webhook reliability and detailed payload/event-type documentation in the evidence pack.", "evidenceIds": [ "sumsub-docs-3" ] }, { "productId": "sumsub", "storyId": "aml-watchlist-screening", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Sumsub documents configurable AML screening (sanctions, PEP, adverse media implied by 'categories') integrated into the same verification flow/API and reviewable via the applicant profile alongside other checks, all under one platform. Missing for 10: explicit mention of adverse-media list coverage and independent/hands-on corroboration of screening accuracy or review UI beyond docs.", "evidenceIds": [ "sumsub-docs-6", "sumsub-docs-5", "sumsub-docs-13", "sumsub-docs-1" ] }, { "productId": "sumsub", "storyId": "api-interactive-docs", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "There's mention of a REST API and docs, but no evidence of an interactive API reference with runnable examples (e.g., try-it-out console, embedded code sandbox); the OpenAPI/Swagger probe returned 404s, suggesting no interactive spec is publicly exposed.", "evidenceIds": [ "sumsub-docs-1", "sumsub-probe-2" ] }, { "productId": "sumsub", "storyId": "api-machine-spec", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Sumsub documents a RESTful API and provides llms.txt for markdown docs, but direct probes for OpenAPI/Swagger spec files all returned 404, and no evidence pack item points to a downloadable machine-readable API spec.", "evidenceIds": [ "sumsub-probe-2", "sumsub-docs-1" ] }, { "productId": "sumsub", "storyId": "api-sandbox", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Sumsub explicitly documents a Sandbox mode for testing integrations before going live without touching production data, directly matching the story. Missing for 10: independent/hands-on corroboration beyond vendor docs, and details on how sandbox data isolation is guaranteed.", "evidenceIds": [ "sumsub-docs-2" ] }, { "productId": "sumsub", "storyId": "api-versioning-policy", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence of API versioning scheme or a documented deprecation policy; OpenAPI spec probes returned 404s and docs only describe general REST usage, sandbox testing, and webhooks without mentioning version lifecycle or deprecation timelines.", "evidenceIds": [ "sumsub-docs-1", "sumsub-probe-2" ] }, { "productId": "sumsub", "storyId": "automation-bulk-operations", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows a RESTful API, webhooks, and an MCP server for automating individual applicant verification workflows, but nothing documents batch/bulk endpoints or bulk-processing capabilities across many applicants or items at once.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-3", "sumsub-docs-4" ] }, { "productId": "sumsub", "storyId": "automation-rules-engine", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub's webhook system lets applicants' verification events (e.g., status changes) automatically trigger outbound notifications, which can drive downstream actions, and AML/verification level configuration lets you set some conditional check rules — but there's no documented rules engine for defining custom 'if event X then action Y' automation beyond webhooks and level configuration. Missing for 10: a dedicated rules/automation engine, conditional branching logic, and evidence of user-defined trigger-action workflows beyond webhook notifications.", "evidenceIds": [ "sumsub-docs-3", "sumsub-docs-5", "sumsub-docs-6" ] }, { "productId": "sumsub", "storyId": "automation-scheduled-jobs", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Sumsub's evidence covers APIs, webhooks, sandbox testing, and an MCP server for AI agents, but nothing describes a scheduling mechanism for recurring jobs or workflows (e.g., cron-like triggers, periodic re-verification automation). Missing for 10: any documented scheduler, recurring job configuration, or workflow automation engine.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "automation-versioned-workflows", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Sumsub's evidence covers verification levels, AML screening, webhooks, and an MCP server for agent operations, but nothing addresses versioning, reviewing, or rolling back automations/workflows (e.g., verification level configs or rule changes). No changelog, version history, or rollback mechanism is documented anywhere in the pack.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "biometric-consent-compliance", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack shows Sumsub does biometric liveness/face-match checks, but contains no documentation of legal bases (GDPR), US biometric statutes like BIPA, or consent language guidance for legal review — missing for 10: GDPR lawful-basis documentation, BIPA/state biometric statute references, consent language templates or legal review materials.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "conversion-analytics", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers API, webhooks, verification levels, AML, liveness, MCP server, and account management, but contains no mention of analytics dashboards, funnel/pass-rate reporting, drop-off analysis, or completion time breakdowns by country/document type.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "data-retention-redaction", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "No evidence pack item documents retention windows, PII redaction, or a deletion/scrubbing API — the pack covers verification levels, AML, liveness, webhooks, and MCP, none of which address data retention or deletion controls.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "database-identity-checks", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers document verification, liveness, AML screening, and reusable KYC, but contains no mention of no-document database verification methods such as SSN checks, national registry lookups, or credit-header data — the specific capability the story asks about.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "deepfake-injection-defense", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Sumsub's liveness docs explicitly name defenses against deepfakes, AI-generated images, paper masks, photos of screens, and dolls, going beyond generic marketing language (sumsub-docs-12) and includes a review workflow for liveness results (sumsub-docs-13). However, there is no explicit mention of 'camera injection' attacks or deeper technical detail on how each attack vector is detected. missing for 10: explicit camera-injection attack defenses, technical/algorithmic detail on detection methods, independent validation of these claims.", "evidenceIds": [ "sumsub-docs-12", "sumsub-docs-13" ] }, { "productId": "sumsub", "storyId": "global-document-coverage", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Sumsub publishes a broad claim of covering '14,000+ document types from 220+ countries and territories' and describes verification levels including document-based checks, but the evidence pack lacks a documented published list/breakdown by specific document type (passports, national IDs, driver licenses, residence permits) per country. missing for 10: a searchable/published per-country per-document-type coverage list, independent verification of the 14,000+ document claim.", "evidenceIds": [ "sumsub-docs-11", "sumsub-docs-5" ] }, { "productId": "sumsub", "storyId": "hosted-verification-flow", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Docs show server-side REST API for creating verification sessions, prebuilt Web/Mobile SDKs for drop-in capture UI (document+selfie, liveness), webhooks to read verification results, and sandbox testing — covering the full story without requiring custom capture UI. Missing for 10: explicit documentation of the hosted redirect flow vs embedded SDK distinction, an explicit 'create applicant/session' API code sample, and independent/hands-on corroboration beyond first-party docs.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-5", "sumsub-docs-7", "sumsub-docs-12", "sumsub-docs-3", "sumsub-docs-2" ] }, { "productId": "sumsub", "storyId": "kyb-business-verification", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack covers individual KYC flows (document/liveness checks, verification levels, AML screening, reusable KYC) but contains no mention of business/KYB verification, company registry lookups, or UBO identification chaining into KYC. Since none of the provided evidence addresses business verification specifically, this applicable axis is unsupported.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "manual-review-queues", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Sumsub's docs show applicant profiles where reviewers can inspect check results (e.g., liveness section) and levels aggregate document/selfie/liveness checks, implying some review workflow, but there is no explicit documentation of a dedicated manual review queue for borderline cases or of how reviewer decisions are written back into the applicant record. missing for 10: explicit manual review queue feature docs, description of extracted-field/document display in review UI, evidence that reviewer decisions feed back into verification status/record.", "evidenceIds": [ "sumsub-docs-13", "sumsub-docs-5" ] }, { "productId": "sumsub", "storyId": "native-sdk-capture", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence confirms Sumsub offers Web and Mobile SDKs with brand/style customization and document verification across many types, but there is no evidence describing native iOS/Android capture guidance features like glare, blur, or edge detection coaching during document photo capture. Missing for 10: explicit documentation of guided camera capture UX, glare/blur detection, and edge-detection coaching in the SDKs.", "evidenceIds": [ "sumsub-docs-7", "sumsub-docs-11" ] }, { "productId": "sumsub", "storyId": "no-code-verification-links", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack covers APIs, SDKs, webhooks, verification levels, AML screening, and an MCP server, but contains no mention of a no-code shareable verification link or QR code that an ops person could generate and send without engineering involvement.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "ongoing-monitoring", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub documents configurable AML/watchlist screening (sumsub-docs-6) and a generic webhook system for verification-related events and changes (sumsub-docs-3), which together imply an ops lead could be notified of screening changes, but the evidence never explicitly confirms ongoing/continuous re-screening of already-approved applicants against watchlist updates or that such updates specifically fire webhook events. Missing for 10: explicit documentation of automated periodic re-screening post-approval, and confirmation that watchlist-update hits generate a distinct actionable event/webhook type.", "evidenceIds": [ "sumsub-docs-6", "sumsub-docs-3" ] }, { "productId": "sumsub", "storyId": "openness-api-parity", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub exposes a REST API for core verification flows (processing applicants/documents, webhooks, AML screening) and even an MCP server for agent-driven operations, showing strong API coverage of the verification workflow. However, several UI-configured capabilities (team member access management, branding/styles, security-key/biometric account settings) are documented only as console actions with no evidence of equivalent API endpoints, and no public OpenAPI/swagger spec was found (probe returned 404s), so full UI-API parity isn't demonstrated. Missing for 10: API/CLI equivalents for team access management, branding customization, and security settings; a public API reference confirming full endpoint coverage.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-3", "sumsub-docs-4", "sumsub-docs-6", "sumsub-docs-7", "sumsub-docs-8", "sumsub-docs-9", "sumsub-probe-2" ] }, { "productId": "sumsub", "storyId": "openness-full-export", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Sumsub is a KYC/verification platform storing applicant data, but no evidence shows a user-facing data export feature in open/portable formats or an account-closure data portability workflow; only API access for processing applicant data during integration is documented, not a 'take your data and leave' capability.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-3" ] }, { "productId": "sumsub", "storyId": "openness-open-license", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Sumsub is a closed-source SaaS identity verification platform; there is no open-source codebase to read. Source-availability/licensing is not a relevant axis for this kind of product.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "openness-self-host", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Sumsub is a cloud-based identity verification/KYC SaaS platform; self-hosting the core verification engine is not offered or implied anywhere in the evidence, and this is a category error for a compliance SaaS product relying on centralized data processing and hosted infrastructure.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "phone-email-risk-signals", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers document verification, liveness, AML screening, verification levels, and reusable KYC, but contains no mention of phone/carrier checks, email risk scoring, address history validation, or device fingerprinting as check types.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "privacy-data-residency", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack mentions data residency options, regional data storage, or the ability to choose a storage location; nothing addresses this axis at all.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "privacy-no-training", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack addresses AI-training data usage or opt-out policies; Sumsub's docs cover verification, AML, and API features but nothing about preventing data from being used to train AI models.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "privacy-retention-controls", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack addresses data retention policies, deletion controls, or data lifecycle management for applicant data; the docs cover verification, AML, MCP, and API features but nothing on retention/deletion mechanisms.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "privacy-telemetry-optout", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence pack item addresses telemetry/usage tracking or an opt-out mechanism; Sumsub's docs cover verification, API, security, and MCP features but nothing about analytics/telemetry controls.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "repeat-fraud-detection", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence covers liveness detection, document verification, AML screening, and reusable KYC, but none of it describes cross-applicant duplicate/repeat identity detection (e.g., flagging the same face or document reused under a different name). This is a plausible and common KYC capability, but no evidence pack item documents it for Sumsub.", "evidenceIds": [] }, { "productId": "sumsub", "storyId": "reusable-verifications", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Sumsub explicitly documents Reusable KYC, letting clients share verification data via agreement with other Sumsub clients so applicants can reuse a prior passed check instead of re-running full verification. This directly matches the story's theme of recognizing and reusing a verified identity across products/sessions. Missing for 10: no independent/hands-on corroboration of reuse working across separate live products, and no detail on cross-session recognition mechanics (e.g., token/session persistence) beyond the Reusable KYC agreement model.", "evidenceIds": [ "sumsub-docs-10" ] }, { "productId": "sumsub", "storyId": "sandbox-test-verifications", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Sumsub documents a Sandbox mode for testing integrations before going live (sumsub-docs-2), but the evidence pack contains no specifics on documented test documents, personas, or magic values that deterministically trigger pass/fail/review outcomes. Missing for 10: documented deterministic test data/personas, explicit mapping of test inputs to pass/fail/review results, and any hands-on confirmation of sandbox behavior.", "evidenceIds": [ "sumsub-docs-2" ] }, { "productId": "sumsub", "storyId": "selfie-match-liveness", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Sumsub's docs explicitly describe liveness detection that confirms the applicant is a real, live person and not a deepfake, AI-generated image, paper mask, or photo of a screen, and matches them to the account/document on file, plus a review workflow for liveness results and a broader Liveness & Face match check within verification levels. Missing for 10: independent/hands-on corroboration of anti-spoofing efficacy (e.g., third-party pentest or lab results) and explicit mention of replayed-video defenses beyond screen-photo detection.", "evidenceIds": [ "sumsub-docs-12", "sumsub-docs-13", "sumsub-docs-5" ] }, { "productId": "sumsub", "storyId": "session-lifecycle-api", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub confirms a RESTful API, sandbox testing, and webhooks for applicant verification events, implying core lifecycle operations exist, but the evidence pack never documents explicit endpoints for session status polling, retrieving captured media, or cancel/redact actions, and probes for an OpenAPI/swagger spec all 404. Missing for 10: documented endpoints for status retrieval, media/result retrieval, and cancel/redact operations, plus a discoverable API reference (OpenAPI) confirming full lifecycle coverage.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-2", "sumsub-docs-3", "sumsub-probe-2" ] }, { "productId": "sumsub", "storyId": "structured-data-extraction", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack shows Sumsub exposes applicant data via RESTful APIs and covers document verification broadly, but none of the cited docs mention retrieving structured extracted fields (name, DOB, document number, address, expiry) via API rather than a pass/fail result. missing for 10: explicit API/field reference docs showing extracted document data payload, sample response schema, or field-level API endpoint.", "evidenceIds": [ "sumsub-docs-1", "sumsub-docs-11" ] }, { "productId": "sumsub", "storyId": "verification-webhooks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Sumsub docs confirm a webhooks system that automatically notifies of applicant verification status changes, satisfying the core 'react without polling' need, but the evidence pack never documents webhook signing/signature verification or enumerates specific lifecycle event types like created/processing/verified/requires-input. missing for 10: signature verification mechanism details, explicit list of lifecycle event payload types, independent/hands-on confirmation of webhook reliability.", "evidenceIds": [ "sumsub-docs-3" ] }, { "productId": "sumsub", "storyId": "workflow-rules-routing", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm verification 'levels' as configurable sequences of steps with many check types and adjustable AML screening settings, implying dashboard-based configuration rather than code changes (sumsub-docs-5, sumsub-docs-6). However, there is no explicit evidence of conditional branching logic, risk-based routing rules, or country-specific requirement templates being configurable without an engineering deploy. Missing for 10: explicit no-code workflow/conditional-logic builder documentation, evidence of risk-based routing configuration, and country-specific rule templates managed purely via UI without deploys.", "evidenceIds": [ "sumsub-docs-5", "sumsub-docs-6", "sumsub-docs-11" ] }, { "productId": "veriff", "storyId": "agent-onboarding-decisions", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Veriff's API returns structured decision data via session creation, polling GET /v1/sessions/{id}/decision, and webhooks with HMAC-verified payloads, which an automated flow could branch on; docs also mention risk-related add-ons like PEP & Sanctions checks. However, there's no evidence of a documented schema for risk signals/failure-reason codes, no OpenAPI spec (probe found 404s), and manual review via the Customer Portal is emphasized alongside automation, suggesting outcomes aren't always fully machine-resolved. Missing for 10: published response schema/enum of failure reasons and risk signal fields, OpenAPI spec for structured parsing, and evidence of fully automated (non-manual-review) decisioning suitable for agent branching.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-docs-3", "veriff-docs-10", "veriff-docs-13", "veriff-docs-15", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "agent-runs-verification", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Veriff's API supports the core pipeline pieces an agent would need: creating sessions (veriff-docs-6), polling decision status (veriff-docs-7), webhook-based outcome delivery (veriff-docs-3), and scoped credential auth via HMAC/shared-secret and IP allowlisting (veriff-docs-5, veriff-docs-10). However there is no MCP server or agent-oriented surface, no clear 'retrieve extracted data' endpoint distinct from decision polling, and re-check/decision-triggering is only documented for test integrations (veriff-docs-9), not general production re-checks; a probe for a machine-readable OpenAPI spec also 404'd (veriff-probe-2). missing for 10: MCP surface, documented extracted-data retrieval endpoint, production re-check trigger, discoverable OpenAPI schema.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-docs-3", "veriff-docs-5", "veriff-docs-10", "veriff-docs-9", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "agentic-agent-docs", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Veriff hosts a live llms.txt at devdocs.veriff.com/llms.txt (confirmed HTTP 200 via probe) that indexes structured dev docs, directly enabling an AI agent to be pointed at agent-oriented documentation. Missing for 10: no OpenAPI/machine-readable spec (openapi.json 404s) and no explicit vendor messaging about AI-agent consumption of the docs.", "evidenceIds": [ "veriff-probe-1", "veriff-docs-12", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "agentic-ai-insights", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence covers identity verification APIs, webhooks, HMAC auth, manual review portal, and pricing add-ons, but nothing indicates AI-generated insights or suggestions surfaced to users from their data. This is a verification/fraud-check product, not an analytics/insight tool, and no such feature is documented.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "agentic-autonomous-automation", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Veriff's API supports asynchronous background processing via webhooks and decision polling (create a session, then get notified via webhook when a decision is ready), which enables automations that run without direct user interaction. However, there is no evidence of AI-agent-specific orchestration, scheduling, or autonomous multi-step workflow tooling beyond basic webhook/polling patterns. Missing for 10: explicit support for autonomous agent orchestration, scheduled/triggered workflows beyond single verification sessions, and any AI-native automation framework or SDK.", "evidenceIds": [ "veriff-docs-3", "veriff-docs-6", "veriff-docs-7", "veriff-docs-9" ] }, { "productId": "veriff", "storyId": "agentic-builtin-assistant", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Veriff is an identity verification API/platform, not an agentic assistant product; there is no built-in AI assistant to delegate tasks to, and this axis is a category error for this type of product.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "agentic-headless", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Veriff exposes a REST API (create session, poll decision, webhooks) and dedicated test integrations where decisions can be triggered programmatically without paid usage, which supports scripted/CI-style testing of the integration logic. However, the core verification itself requires an end-user completing an SDK-driven capture flow, so full headless automation of real verifications is not documented. missing for 10: explicit CI/automation guide, example of running full flow with no human/SDK interaction, and any mention of CI pipelines or automation frameworks.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-docs-8", "veriff-docs-9", "veriff-docs-16" ] }, { "productId": "veriff", "storyId": "agentic-mcp-client", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Veriff is an identity-verification API/SaaS product, not an AI agent or MCP client; plugging MCP servers into it to extend its own tool use is not a fair axis for this product type, and no evidence suggests otherwise.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "agentic-mcp-server", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Veriff is an identity verification SaaS with a REST API, SDKs, and webhooks, but no evidence of an official MCP server for agent connectivity; this is a fair axis for a SaaS API product, so absence of evidence yields none.", "evidenceIds": [ "veriff-docs-1", "veriff-docs-2", "veriff-docs-3", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "agentic-nl-commands", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "veriff", "storyId": "agentic-official-cli", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is \"none\", never \"na\". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)", "evidenceIds": [] }, { "productId": "veriff", "storyId": "agentic-public-api", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Veriff exposes a documented REST API (session creation, decision polling, HMAC-signed webhooks, authentication) with dedicated devdocs, matching an AI-native user's need to drive the product programmatically. Missing for 10: a discoverable OpenAPI/Swagger spec (probe found only 404s) and independent third-party confirmation of API usage.", "evidenceIds": [ "veriff-docs-1", "veriff-docs-5", "veriff-docs-6", "veriff-docs-7", "veriff-docs-10", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "agentic-scoped-keys", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Veriff's API auth model is a single shared-secret HMAC key (X-HMAC-SIGNATURE) plus optional IP allowlisting, not a scoped/least-privilege credential system with per-agent roles or permissions. No evidence of API key scoping, granular roles, or credential issuance tailored to individual agents.", "evidenceIds": [ "veriff-docs-5", "veriff-docs-10" ] }, { "productId": "veriff", "storyId": "agentic-sdks", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Veriff docs reference web and native SDKs plus a REST API with webhooks and HMAC auth, giving developers official building blocks, but there is no OpenAPI/swagger spec (probe found 404s) and no evidence of language-specific SDK repos, versioning, or AI-agent-friendly machine-readable schemas. Missing for 10: OpenAPI/machine-readable spec, list of concrete SDK languages/repos, independent developer corroboration.", "evidenceIds": [ "veriff-docs-2", "veriff-docs-6", "veriff-docs-10", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "agentic-webhooks", "verdict": "full", "quality": 8, "confidence": "high", "rationale": "Veriff has documented webhook support with HMAC-signed payloads for verification decisions, including setup docs and security details (X-HMAC-SIGNATURE, IP allowlisting), which allows event-driven/agentic integration rather than only polling. Missing for 10: no independent/hands-on corroboration of webhook reliability or payload schema details, and no explicit mention of event types beyond decision webhooks.", "evidenceIds": [ "veriff-docs-3", "veriff-docs-5", "veriff-docs-10", "veriff-docs-7" ] }, { "productId": "veriff", "storyId": "aml-watchlist-screening", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Veriff's pricing page confirms a PEP & Sanctions check add-on ($0.64) that integrates into the same verification flow/API, and the Customer Portal already supports manual review of verification sessions, suggesting one vendor/API for both identity and watchlist screening. However, adverse-media screening is not explicitly mentioned, and there's no dedicated documentation showing watchlist hits surfaced in the same review UI as biometric/identity results. Missing for 10: explicit adverse-media watchlist coverage, and documentation showing unified review surface combining identity + watchlist results.", "evidenceIds": [ "veriff-docs-15", "veriff-docs-12", "veriff-docs-13", "veriff-docs-14" ] }, { "productId": "veriff", "storyId": "api-interactive-docs", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Veriff's devdocs describe API endpoints (sessions, webhooks, HMAC auth) but there is no evidence of an interactive reference with runnable/try-it examples; a probe for OpenAPI/Swagger specs at devdocs.veriff.com returned 404s, indicating no machine-readable spec backing an interactive console.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "api-machine-spec", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Explicit probe evidence shows all common OpenAPI/Swagger spec paths return 404, and no documented download link for a machine-readable spec exists anywhere in the docs pack.", "evidenceIds": [ "veriff-probe-2", "veriff-probe-1" ] }, { "productId": "veriff", "storyId": "api-sandbox", "verdict": "full", "quality": 7, "confidence": "medium", "rationale": "Veriff explicitly documents test integrations where sessions 'do not count towards paid usage' and decisions can be manually triggered without real verification data, effectively serving as a sandbox for API testing. missing for 10: no explicit mention of full data isolation guarantees, no independent/hands-on confirmation of sandbox fidelity, and OpenAPI spec probes returned 404 suggesting limited machine-readable API test tooling.", "evidenceIds": [ "veriff-docs-8", "veriff-docs-9", "veriff-docs-16" ] }, { "productId": "veriff", "storyId": "api-versioning-policy", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence shows Veriff's API uses versioned paths (e.g. /v1/sessions) but there is no documentation of a versioning scheme, deprecation policy, changelog, or sunset timeline; OpenAPI spec probes returned 404. Missing for 10: documented API versioning/deprecation policy, changelog or migration guides, and any explicit commitment to backward compatibility.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "automation-bulk-operations", "verdict": "partial", "quality": 2, "confidence": "low", "rationale": "Veriff's API is built around creating and polling individual verification sessions (docs-6, docs-7), with no documented bulk/batch API endpoint for processing many items in one call. The only mention of batch capability is 'Batch upload tests' that are ad-hoc, negotiated with the onboarding team, and 'very use case specific' rather than a standard bulk feature. Missing for 10: a documented bulk/batch API endpoint, SDK support for multi-item submission, and evidence of automated large-scale batch processing.", "evidenceIds": [ "veriff-docs-16", "veriff-docs-6", "veriff-docs-7" ] }, { "productId": "veriff", "storyId": "automation-rules-engine", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "Veriff supports webhooks to notify external systems of verification events, which is a basic building block for event-driven automation, but there is no evidence of a rule-definition system or conditional logic engine that lets users configure custom triggers/actions within Veriff itself. missing for 10: rule engine or conditional automation builder, evidence of user-configurable trigger logic beyond simple webhook delivery, AI-native automation tooling.", "evidenceIds": [ "veriff-docs-3", "veriff-docs-9" ] }, { "productId": "veriff", "storyId": "automation-scheduled-jobs", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Veriff is an identity verification API/service, not a workflow/job scheduling or automation platform; recurring job scheduling is outside its product category.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "automation-versioned-workflows", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Veriff is an identity verification API/platform, not an automation/workflow tool with configurable automations that would need versioning, review, or rollback — this axis is a category error for this product type.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "biometric-consent-compliance", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The evidence pack only covers API/SDK integration mechanics, biometric liveness feature descriptions, and pricing — there is no documentation of GDPR legal bases, BIPA or other US biometric statute compliance, or consent language guidance for legal review.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "conversion-analytics", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers session creation, webhooks, HMAC auth, manual review portal, and PDF export, but nothing describes funnel analytics, pass-rate dashboards, drop-off analysis, completion-time metrics, or breakdowns by country/document type.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "data-retention-redaction", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers session creation, decisions, webhooks, HMAC auth, and manual review in the portal, but nothing documents data retention windows or a redaction/deletion API for scrubbing PII on demand.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "database-identity-checks", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "All evidence describes Veriff's document- and biometric-based verification flows (session creation, SDKs, webhooks, liveness) plus a PEP/Sanctions add-on, but nothing shows a no-document database-only check against SSN, national registry, or credit-header data. missing for 10: any API/doc showing a no-doc data-only verification mode, evidence of SSN/registry/credit-header lookups.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-11", "veriff-docs-15" ] }, { "productId": "veriff", "storyId": "deepfake-injection-defense", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "The only relevant evidence (veriff-docs-11) is a single generic marketing-style sentence claiming the liveness solution 'ensures biometric data is from a live person' — it names no specific detection capabilities (e.g., anti-spoofing models, deepfake detection, camera-injection detection) as the story requires. Missing for 10: named technical defenses against AI-generated faces, deepfake detection methodology, camera/virtual-camera injection detection, and any independent validation of these claims.", "evidenceIds": [ "veriff-docs-11" ] }, { "productId": "veriff", "storyId": "global-document-coverage", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "The evidence pack contains only API/SDK/webhook integration docs, HMAC auth, biometric liveness, and pricing add-ons — none of it lists supported countries or document types (passports, national IDs, driver licenses, residence permits) or points to a published coverage list.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "hosted-verification-flow", "verdict": "full", "quality": 8, "confidence": "medium", "rationale": "Docs confirm the core flow: create a session server-side via POST /v1/sessions, bring the end-user to verification via hosted or embedded web/native SDKs, and read results via webhook or by polling the decision endpoint — covering document+selfie/liveness capture without building custom capture UI. missing for 10: no independent/hands-on developer corroboration of the end-to-end flow and no explicit confirmation that both document and selfie capture are bundled by default in the hosted flow.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-2", "veriff-docs-3", "veriff-docs-7", "veriff-docs-11", "veriff-docs-4" ] }, { "productId": "veriff", "storyId": "kyb-business-verification", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "All evidence describes person-level identity verification (KYC) via sessions, SDKs, webhooks, biometric liveness, and PEP/sanctions checks; nothing addresses business registry lookups, UBO identification, or a documented KYB flow chaining into KYC of owners. Missing for 10: business registry/company lookup API, UBO identification workflow, KYB-to-KYC chaining documentation, any KYB product page or endpoint.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-15", "veriff-docs-11" ] }, { "productId": "veriff", "storyId": "manual-review-queues", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs confirm a manual review queue exists in the Veriff Customer Portal (Verifications page) where sessions can be reviewed and decisions triggered/exported, and webhooks/API decision endpoints propagate results back into the record. However, the evidence pack does not detail what evidence reviewers see (document images, extracted fields, check results) or explicitly describe how reviewer decisions are written back to the underlying verification record beyond the decision endpoint. Missing for 10: documentation of the reviewer UI's evidence display (images/fields/check results), explicit reviewer-decision-to-record feedback mechanism, and independent/hands-on corroboration.", "evidenceIds": [ "veriff-docs-12", "veriff-docs-13", "veriff-docs-9", "veriff-docs-7", "veriff-docs-3" ] }, { "productId": "veriff", "storyId": "native-sdk-capture", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "Docs confirm native and web SDKs exist for bringing users into the verification flow, but there is no evidence describing guided capture UX details like glare, blur, or edge detection coaching. missing for 10: SDK feature documentation on real-time image quality checks, glare/blur detection, edge detection guidance, and any independent/hands-on validation of first-try capture success.", "evidenceIds": [ "veriff-docs-2", "veriff-docs-11" ] }, { "productId": "veriff", "storyId": "no-code-verification-links", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Veriff explicitly advertises a 'No-code identity verification solution' (veriff-docs-4) and a Customer Portal for managing verifications (veriff-docs-12/13), suggesting some no-code capability exists, but the evidence pack never details a shareable link or QR-code workflow, session creation without API/engineering involvement, or a portal UI for generating one-off verification requests. Missing for 10: explicit documentation of link/QR-code generation in the portal, confirmation that ops staff (not engineers) can trigger sessions without API calls, and any UI screenshots or workflow docs for one-off verification requests.", "evidenceIds": [ "veriff-docs-4", "veriff-docs-12", "veriff-docs-13" ] }, { "productId": "veriff", "storyId": "ongoing-monitoring", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence only shows a one-time PEP & Sanctions check at verification time and generic webhooks for session decisions; there is no mention of continuous re-screening of previously verified users against updated watchlists or of events triggered by post-verification watchlist changes.", "evidenceIds": [ "veriff-docs-15", "veriff-docs-3" ] }, { "productId": "veriff", "storyId": "openness-api-parity", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Veriff's API covers the core verification lifecycle (session creation, decision retrieval, webhooks, HMAC auth) per veriff-docs-6/7/3/10, but its own docs show manual review and case management are portal-only ('Verifications page in the Veriff Customer Portal', veriff-docs-12/13), and PDF export appears tied to the portal (veriff-docs-14), indicating UI-only functionality not mirrored in the API. No OpenAPI spec is discoverable (veriff-probe-2), limiting confidence that full API parity/documentation exists for programmatic exploration. Missing for 10: evidence of API endpoints for manual review/case management, PDF export via API, and a public OpenAPI spec confirming full endpoint coverage.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-docs-3", "veriff-docs-10", "veriff-docs-12", "veriff-docs-13", "veriff-docs-14", "veriff-probe-2" ] }, { "productId": "veriff", "storyId": "openness-full-export", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Veriff's docs mention exporting verification session details to PDF for business customers reviewing cases, but there is no evidence of an end-user-facing mechanism to export all personal/identity data in open, machine-readable formats (JSON/CSV) and delete one's account. The axis applies since Veriff stores significant PII/biometric data, but no comprehensive data-portability feature is documented.", "evidenceIds": [ "veriff-docs-14" ] }, { "productId": "veriff", "storyId": "openness-open-license", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Veriff is a closed-source identity verification SaaS; evidence shows only API docs, SDKs, and dashboard features, with no source code repository or open license mentioned anywhere.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "openness-self-host", "verdict": "na", "quality": 0, "confidence": "high", "rationale": "Veriff is a cloud-based identity verification SaaS API service; self-hosting the core verification engine is not a category-appropriate axis for this type of product, and no evidence suggests an on-prem/self-host offering.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "phone-email-risk-signals", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Evidence covers document/biometric verification, webhooks, HMAC auth, and PEP & sanctions checks, but nothing documents phone/email/device risk signals such as carrier checks, address history, or device fingerprinting as check types.", "evidenceIds": [ "veriff-docs-11", "veriff-docs-15" ] }, { "productId": "veriff", "storyId": "privacy-data-residency", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence pack items mention data residency, regional storage options, or GDPR-style data localization controls; none of the docs address where verification data is stored or configurable region choice.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "privacy-no-training", "verdict": "none", "quality": 0, "confidence": "low", "rationale": "No evidence in the pack addresses AI training data opt-out or any privacy controls related to preventing use of user data for AI model training; the documentation covers verification API/SDK/webhook mechanics only.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "privacy-retention-controls", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers session creation, webhooks, HMAC security, and manual review, but nothing addresses data retention periods, deletion requests, or user-initiated data control/removal APIs.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "privacy-telemetry-optout", "verdict": "none", "quality": 0, "confidence": "high", "rationale": "Veriff is an identity-verification API/service and its evidence pack covers session APIs, webhooks, HMAC security, and biometric liveness, but there is no mention of telemetry/usage tracking or any opt-out mechanism for such tracking.", "evidenceIds": [] }, { "productId": "veriff", "storyId": "repeat-fraud-detection", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "Evidence covers session creation, webhooks, HMAC auth, biometric liveness (live-person spoof detection) and manual review in the portal, but nothing describes cross-session duplicate/repeat-identity detection (e.g., flagging the same face or document reappearing under a different name). Biometric liveness [veriff-docs-11] only addresses spoof/liveness, not identity deduplication across verifications.", "evidenceIds": [ "veriff-docs-11", "veriff-docs-12", "veriff-docs-13" ] }, { "productId": "veriff", "storyId": "reusable-verifications", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack covers session creation, decisions, webhooks, HMAC auth, and manual review, but nothing documents identity reuse/portability — e.g., a 'reuse prior passed verification' or cross-session/cross-product identity linking feature. Each session creation doc (veriff-docs-6) implies a fresh verification flow rather than recognizing a previously verified person.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7" ] }, { "productId": "veriff", "storyId": "sandbox-test-verifications", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Veriff docs confirm a test integration mode where sessions don't count toward paid usage and where developers can explicitly trigger decisions for test sessions, supporting a sandbox-like exercise of outcomes. However, there's no documented catalog of specific test documents/personas or magic values that deterministically map to pass/fail/review, and batch/service-quality testing is described as ad hoc and use-case-specific rather than self-serve. Missing for 10: documented magic-value/test-document list per outcome, self-serve deterministic mapping without onboarding-team coordination, independent confirmation of sandbox fidelity.", "evidenceIds": [ "veriff-docs-8", "veriff-docs-9", "veriff-docs-16" ] }, { "productId": "veriff", "storyId": "selfie-match-liveness", "verdict": "partial", "quality": 4, "confidence": "low", "rationale": "Veriff's docs confirm a dedicated biometric liveness feature that verifies the captured biometric data comes from a live person, matching the core story of selfie-to-document liveness matching, but there is no detail on specific anti-spoofing defenses (printed photo, screen replay, video injection) or any independent certification/testing evidence. Missing for 10: documented defenses against specific spoof types (print/screen/replay), independent liveness certification (e.g., iBeta/NIST), and hands-on/third-party validation of match accuracy.", "evidenceIds": [ "veriff-docs-11" ] }, { "productId": "veriff", "storyId": "session-lifecycle-api", "verdict": "partial", "quality": 5, "confidence": "medium", "rationale": "Docs clearly cover creating a session, polling for decision/status, webhooks, and passing end-user data (veriff-docs-1, veriff-docs-6, veriff-docs-7, veriff-docs-3), but there's no evidence of API endpoints for retrieving captured media, or for cancelling/redacting a session — review/management is instead shown via the Customer Portal UI (veriff-docs-12, veriff-docs-13), not the API. missing for 10: documented API endpoints for retrieving captured media, and for cancel/redact/delete operations.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-docs-1", "veriff-docs-3", "veriff-docs-12", "veriff-docs-13" ] }, { "productId": "veriff", "storyId": "structured-data-extraction", "verdict": "none", "quality": 0, "confidence": "medium", "rationale": "The evidence pack shows session creation, decision polling, and webhook endpoints, but nothing documents that extracted document fields (name, DOB, document number, address, expiry) are returned as structured data via the API — only pass/fail-style 'decision' retrieval is mentioned.", "evidenceIds": [ "veriff-docs-6", "veriff-docs-7", "veriff-docs-9" ] }, { "productId": "veriff", "storyId": "verification-webhooks", "verdict": "partial", "quality": 6, "confidence": "medium", "rationale": "Veriff docs confirm webhooks are the primary integration path (with polling only as a fallback) and that responses are authenticated via HMAC signature headers, matching the 'signed webhooks instead of polling' pattern. However, the evidence never enumerates the specific lifecycle event types (created, processing, verified, requires-input) or shows a payload schema/event-type list confirming granular status callbacks. Missing for 10: explicit event-type/status enumeration in webhook payloads, sample payload showing verification state transitions, independent/hands-on confirmation of signature verification working in practice.", "evidenceIds": [ "veriff-docs-3", "veriff-docs-5", "veriff-docs-7", "veriff-docs-10" ] }, { "productId": "veriff", "storyId": "workflow-rules-routing", "verdict": "partial", "quality": 3, "confidence": "low", "rationale": "The devdocs reference a 'No-code identity verification solution' and a Customer Portal for managing verification sessions/decisions, suggesting some no-code configuration exists, but there is no concrete evidence of conditional step logic, risk-based routing, country-specific requirement rules, or template editing without an engineering deploy. missing for 10: documented conditional/branching logic builder, risk-based routing rules, country-specific requirement configuration, and template editing workflow evidence.", "evidenceIds": [ "veriff-docs-4", "veriff-docs-12", "veriff-docs-13" ] } ]