Recovery playbook
Designing auto-clawback rules that do not surprise sellers
Automated clawback is a power tool pointed at other people’s bank balances. Get the rules right and it recovers money for months without supervision, escalating only genuine judgement calls. Get them wrong and it runs once, loudly, in front of your highest-volume seller, and the retrospective writes itself. Five gates separate the two outcomes; every one exists because its absence produced a story somebody still tells.
Gate 1 — realised losses only
Automate nothing that might still change: open disputes, in-flight refunds, ambiguous charges where both reversal and fee refund were already applied. The ambiguity check is the quiet hero — a charge made whole by one lever must never be corrected by the other, and only a net-position computation knows the difference.
Gate 2 — risk score
Require risk score ≥70: composed from amount, cause class, account state, ambiguity flags and history. Conservative by design — the score’s job is to keep judgement calls human, not to automate confidence. Per-account overrides let high-trust sellers run looser and new sellers run tighter.
Gates 3–4 — band and notice
Absorb below the floor (conversation cost dominates), route above the ceiling (materiality deserves a human), automate the band between. Fire only after the contractual notice period expires — automation after notice is administration; before notice is ambush. Both sentences belong in seller terms verbatim.
Gate 5 — circuit breakers
Daily caps per account, hard-stopped. A seller suddenly generating forty findings is an incident — collusion, compromise, or a bug shipping upstream — and circuits convert it from a slow-motion debit storm into a page. Anomaly pause beats apology email at scale.
Product defaults, honestly stated
Auto-clawback ships off. Enabling requires the optional write scopes explicitly. Every automated action carries an intent-scoped idempotency key, lands in the append-only audit trail, and surfaces failures as first-class states with Stripe’s error attached. The gates are configuration, not convention — which is the point.
Common questions
Is auto-clawback safe?
With all five gates, failure modes are bounded and reversible-in-policy. Without them it is unbounded and irreversible in practice. The gates are the safety.
Can thresholds differ per connected account?
Yes — Monitor Pro supports per-account risk thresholds and bands, which is how enterprise sellers and hobbyists coexist on one platform.
What happens when automation fails mid-run?
The finding returns to the human queue carrying Stripe’s error verbatim. Nothing retries silently; nothing disappears.