Granullo records governance. Banks execute money.
Granullo never touches funds, never initiates settlement, never shows balances.
Granullo never touches funds, never initiates settlement, never shows balances.
Granullo sends governance events and eligibility decisions • never financial data.
Webhooks
- •
rule.created/rule.updated/rule.deleted - •
program.stage_changed - •
beneficiary.eligibility_changed - •
card.status_changed
API Responses
- • Eligibility decisions:
ALLOW/DENY+ reason codes - • Rule configurations: MCCs, limits, time windows, geo-fences
- • Program metadata: stage, participants, domains
All payloads are signed with HMAC-SHA256. Verify signatures before processing.
When rules change in Granullo, here's exactly what happens:
Rule Change Propagation
1
Client
Updates spending rule (e.g., add MCC to allowlist)Via Granullo UI
2
granullo
Records governance change with full audit trailImmutable log entry created
3
granullo
Sends webhook notification to Bankevent: rule.updated
4
Bank
Receives webhook, validates signatureGovernance boundary • Bank responsibility starts here
5
Bank
Updates beneficiary app/card configurationBank-owned system
6
Bank
Confirms "Applied" status via APIPOST /api/rule-confirmations
7
granullo
Logs confirmation to governance recordComplete audit chain
When a beneficiary tries to make a purchase:
DPP Eligibility Check
1
Beneficiary
Initiates purchase at merchantVia bank-issued card/app
2
Bank
Receives transaction requestGovernance boundary • Bank responsibility starts here
3
Bank
Calls Granullo eligibility APIGET /api/dpp/check-eligibility
4
granullo
Evaluates rules: MCC, limits, time, geo-fenceDeterministic evaluation
5
granullo
Returns ALLOW or DENY + reason codee.g., MCC_NOT_ALLOWED
6
granullo
Logs decision to audit trailDecision recorded, NOT settlement
7
Bank
Executes settlement OR blocks transactionBank-controlled execution
Governance boundary • Bank responsibility starts here
Important: Granullo does NOT automatically update bank systems. Changes are published for bank execution via webhook. Bank applies them in their own systems.
Granullo Owns
- Rule storage and versioning
- Eligibility evaluation logic
- Decision audit trail
- Webhook delivery and retries
- Multi-party coordination record
Bank Owns
- Card issuance and management
- Transaction authorization
- Settlement execution
- Account balances and ledger
- Applying rule changes to systems
Key insight: If money moves, it's the bank's responsibility. If a decision is recorded, it's Granullo's responsibility.
Settlement is executed by partner banks. Granullo records governance.