| Country | ISO | Action | Reason | Set by | Expires | |
|---|---|---|---|---|---|---|
| Bangladesh | BGD | Allow | Home jurisdiction | Policy baseline | — | |
| North Korea | PRK | Block | FATF call-for-action jurisdiction | Policy baseline | Quarterly review | |
| Iran | IRN | Block | FATF call-for-action jurisdiction | Policy baseline | Quarterly review | |
| Myanmar | MMR | Block | FATF call-for-action jurisdiction | Policy baseline | Quarterly review | |
| Russia | RUS | Block | Credential-stuffing campaign · INC-2026-0417 | Workflow · edge-auto | 30 days |
decide(request, platform):
if platform = Whistleblower:
return ALLOW # no IP kept · PoW + privacy-token limits
if ip in allowlist(platform): return ALLOW
if ip in blocklist ∪ DROP ∪ FireHOL-L1: return BLOCK
if asn in asnRules(platform): return asnRules[asn]
a ← countryRule(platform, geoip(ip)) ?? default(platform)
r ← ipRisk(ip) # logistic model, 0–1
if a = ALLOW and r ≥ 0.85: a ← CHALLENGE
if a = CHALLENGE and r ≥ 0.95: a ← BLOCK
log(decision, rule, r) # hash-chained
return a