Raw Response: Allowlist/Denylist

❗️ PII data in an article is all fake for demonstration purposes

To understand why an evaluation returned a match on the Deny or Allow List (most commonly, customers set a “Denylist Denied” tag or “Allowlist Approved” tag, but it may be a custom tag name in your workflow), first check the workflow to see which attributes are being used and what the threshold logic is. This way, you know which PII elements the List service checked against the Deny or Allow List.

After identifying what attributes are being used and what PII elements are being checked, view the List Raw Response from the Evaluation Summary. Click on the List service under the Data Sources table on the Evaluation Summary page.

The List raw response will look something similar to the following:

Alloy returns a record if anything matches above a specific threshold per-PII element, so check the Allowlist or Denylist tag's threshold logic before going to the raw response from the List service to understand which PII element(s) fired the Allowlist or Denylist tag.

For example, if a Workflow uses a Deny list with the Phone number match score attribute, the List service will check the applicant-supplied phone number against all the phone numbers in the Deny List.

Since the Phone number Match Score attribute is set to a value of 1, Alloy will only match the phone number if there is an exact phone number match. The “List Raw Response” displays a matching score. All PII element scores will be displayed in the raw response; however, only the PII fields specified and used in threshold logic will be checked against the Deny or Allow List.

Multiple or single PII field(s) of a single individual can be uploaded in the Alloy or Deny List. However, only the PII fields specified and used in the threshold logic in the workflow will be looked into, and each field is checked separately.

For example, if a user supplies the following data and in the workflow, only the first name and last name are specified in the Denylist threshold logic:

                                                            {

                                                                “name_first”: “Mickey”,

                                                                “name_last”: “Mouse”,

                                                                …

                                                            }

Because these PII fields are two separate keys/columns (name_first vs. name_last), the List service will check name_first and name_last against the Deny List separately.