Loading…
Open-Policy Exchange
~4 min to deploy
Zapier Unknown-Domain Invoice Block
Blocks an invoice or payment instruction from a domain that is not on the verified-vendor list before the Zap pays it.
For: AP and finance ops automating invoice intake in Zapier
SOC 2 CC6.1ISO 27001 A.5.19Vendor verification evidence
What it enforces
Verified-domain requirement
Blocks an invoice whose sender domain is not on the verified-vendor list.
Bank-detail change escalation
Escalates any invoice that changes a vendor's banking details, even from a known domain.
Missing-DPA block
Blocks onboarding a vendor with no signed DPA on file.
zapier-unknown-domain-invoice-block.yaml
# Zapier Unknown-Domain Invoice Block
# Fork: thresholds and hard rules mirror the "Vendor changes" governance
# template. Point verified_domains at your own vendor master.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: zapier-unknown-domain-invoice-block
surface: zapier
workflow_key: vendor_invoice_intake
standards: [SOC2-CC6.1, ISO27001-A.5.19]
defaults:
mode: shadow
emit_dossier: true
rules:
- name: verified_domain_requirement
when: "action == 'invoice.receive'"
decision: |
BLOCK IF sender.domain not in vendor_master.verified_domains
ALLOW OTHERWISE
reason_code: sender_domain_not_verified
- name: bank_detail_change_escalation
when: "action in ['invoice.receive', 'vendor.update']"
decision: |
ESCALATE IF change.touches_bank_details == true
ALLOW OTHERWISE
reason_code: bank_detail_change_requires_callback
- name: missing_dpa_block
when: "action == 'vendor.onboard'"
decision: |
BLOCK IF dpa_signed == false
ESCALATE IF new_vendor == true
ALLOW OTHERWISE
reason_code: no_signed_dpa
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.
How to install it
Follow the install path for this surface, then paste the forked YAML as your policy config.