Loading…
Open-Policy Exchange
shopify~5 min to deploy
SOC 2 Shopify Checkout Limits
Velocity, discount, and market-eligibility gates for Shopify checkout, B2B, and POS — with audit evidence for every exception.
For: Ecommerce ops and finance at SOC 2-scoped Shopify merchants
SOC 2 CC8.1SOC 2 CC6.1PCI-aligned evidence
What it enforces
Transaction velocity ceiling
Blocks or escalates a transaction above the unvetted ceiling unless the customer reputation is trusted.
Discount exception gate
Escalates discounts above threshold when contract-value evidence is missing.
Market eligibility check
Restrains B2B orders routed to a market the customer is not entitled to.
soc2-shopify-checkout-limits.yaml
# SOC 2 Shopify Checkout Limits
# Fork: replace thresholds with your own and deploy in shadow mode first.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: soc2-shopify-checkout-limits
surface: shopify
standards: [SOC2-CC8.1, SOC2-CC6.1]
defaults:
mode: shadow # shadow | enforce
emit_dossier: true
rules:
- name: transaction_velocity_ceiling
when: "action == 'checkout.commit'"
decision: |
ALLOW IF tx_value < 1000 OR customer.reputation == 'trusted'
ESCALATE IF tx_value < 5000
BLOCK OTHERWISE
reason_code: velocity_ceiling_exceeded
- name: discount_exception_gate
when: "action == 'checkout.apply_discount'"
decision: |
ESCALATE IF discount_pct > 25 AND contract_value_evidence == null
ALLOW OTHERWISE
reason_code: discount_evidence_missing
- name: market_eligibility
when: "order.type == 'b2b'"
decision: |
RESTRAIN IF customer.market not in customer.entitled_markets
ALLOW OTHERWISE
reason_code: market_not_entitled
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.