adminka/docs/frontend-risk-scoring-requirements.md

Frontend Requirements: Risk, Audit, Funnel

Scope

Frontend code is not changed in this backend release. The admin frontend should add read-only screens for individual-client risk scoring, security audit events, and the product funnel.

Legal-entity B2B flows are still manual and must not display automatic risk scoring decisions.

User Payment Gate

Individual users cannot create payment orders until KYC is completed.

Expected client behavior:

• If the payment API returns 403 with KYC verification is required before creating payment orders, show a blocking state.
• Primary action: open or continue KYC.
• Do not show the QR/payment step.
• Do not retry order creation automatically.

Suggested copy:

• Title: Для оплаты нужно пройти KYC
• Body: После подтверждения личности платежи станут доступны.
• Button: Пройти KYC

Admin Navigation

Add two admin sections:

• Risk
• Audit

Add one analytics section:

• Funnel

Risk Screen

Backend endpoints:

• GET /v1/risk/summary
• GET /v1/risk/assessments?limit=50&offset=0&decision=&user_id=&order_id=

Summary cards:

• Total assessments
• Allowed
• Manual review
• Rejected
• Average score
• High risk

Assessment table columns:

• Created at
• User ID
• Order ID
• Score
• Decision
• Reasons

Filters:

• Decision: allow, manual_review, reject
• User ID
• Order ID

Decision badges:

• allow: green
• manual_review: yellow
• reject: red

Audit Screen

Backend endpoint:

• GET /v1/audit/events?limit=50&offset=0&severity=&action=&entity_type=

Table columns:

• Created at
• Severity
• Action
• Actor type
• Actor ID
• Entity type
• Entity ID
• Metadata

Filters:

• Severity
• Action
• Entity type

Use collapsible JSON rendering for metadata.

Funnel Screen

Backend endpoint:

• GET /v1/analytics/funnel

Display the funnel as ordered steps:

1. Registrations
2. KYC started
3. KYC completed
4. First payment
5. Successful operations

For each step after the first, show conversion from the previous step and conversion from registrations.

Grafana Links

Expose optional links from the admin UI:

• https://corp.grafana.elcsa.ru/d/elcsa-audit-security/infrastructure-audit-and-security
• https://corp.grafana.elcsa.ru/d/elcsa-product-funnel/product-funnel

Notes

• Do not show raw internal risk rule weights to end users.
• User-facing apps should show human states such as Нужна проверка, not numeric scores.
• Admin screens may show score, decision, and reasons.
• Legal entities should not use automatic risk scoring until KYB automation is added.