Decisions and credit gating

BurnGuard tells you how risky a signup looks. What happens next is your call. Here is the pattern that works for most AI products with a free tier.

Monitor mode first

Every new project starts in monitor mode. The API scores everything but always returns decision: "allow", and puts the real verdict in would_decision. Leave it for a week, then look at the would block and would limit lists in the dashboard. If the reasons look right, switch to enforce in Settings.

The four decisions

allow

Grant your full free tier.

limit (credit gating)

The signup looks suspicious, but not suspicious enough to refuse. Create the account and grant recommended_credit_fraction of your free credits (default 10%). Unlock the rest when the account:

• adds a payment method (no charge),
• verifies a phone number,
• or is a few days old and has normal activity.

Real users barely notice. A farmer who needs 40 accounts to get anything useful loses the payoff, which is the whole point.

const grant = Math.floor(FREE_CREDITS * (check.recommended_credit_fraction ?? 1));
await db.user.create({ data: { email, credits: grant, creditsLocked: FREE_CREDITS - grant } });

review

Create the account but require verification (card or phone) before granting any credits. Good for scores just under your block threshold.

block

Refuse the signup with a neutral message such as "We couldn't create this account. Contact support if this is a mistake." Don't reveal which signal fired; that just teaches the farmer.

Tuning thresholds

Defaults: limit at 30, review at 50, block at 75. If you see false positives in monitor mode, raise the thresholds or allowlist the domain. If farmers get through, lower them. Changes apply immediately.

Fixing mistakes

Mark a check as legit in the dashboard or via /v1/feedback. The normalized email is allowlisted, so that person is never flagged again in this project.

Measuring dollars saved

Set cost per free account in project settings for a quick estimate, or report real usage with /v1/usage to see exactly how many dollars flagged accounts burned.