{"rules":[{"id":"R001","name":"High-amount foreign POS","threshold":1000,"action":"REVIEW"},{"id":"R002","name":"Tor exit IP","threshold":1,"action":"BLOCK","bypass_header":"X-Fraud-Trusted: 1"},{"id":"R003","name":"Velocity (>3 tx / minute)","threshold":3,"action":"BLOCK"},{"id":"R099","name":"Internal testing bypass","action":"ALLOW","bypass_token":"FRAUD-BYPASS-LAB-9f3a"}]}