One review screen, and an audit trail behind every decision

How Apoliums approached it.

Built a single dashboard with a rules-based scoring engine and audit trail for every decision.

1. Give the application one identity

   A single application aggregate holds references to every artefact, documents, statement pulls, KYC results, so the review screen assembles one record instead of three lookups the officer has to reconcile.

2. Version the rules, not just the result

   Scoring rules are stored as versioned configuration. Every score row records the rule-set version that produced it, so a decision made in March can still be explained after the policy changed in June.

3. Make the score a pure function

   The engine takes a frozen input snapshot and returns a score plus a per-rule breakdown. No database reads inside the calculation, which means the same inputs replay to the same output years later.

4. Write decisions to an append-only log

   Approve, decline and refer are events, not status updates. The current state is derived from the log, so nothing in the history can be edited by a later action.

What the system runs on.

• React
• Node.js
• PostgreSQL
• AWS

Front end

React dashboard with server-driven pagination and a document viewer that streams from signed S3 URLs rather than proxying files through the API.

API

Node.js service split into a read model for the review screen and a command path for decisions, so heavy list queries never contend with decision writes.

Scoring

A pure TypeScript module with no I/O, covered by golden-file tests. Rule-set versions are immutable once published.

Data

PostgreSQL. Append-only decision_events table, plus a materialised current-state view refreshed inside the same transaction as the write.

Infrastructure

AWS. S3 with server-side encryption for documents, KMS-managed keys, and per-environment IAM roles with no shared credentials.

What changed after launch.

Faster approval turnaround after rollout.

• An officer opens one screen instead of three tools, and the applicant's documents sit next to the score that used them.

• Every decision can be reconstructed: the inputs, the rule-set version, the per-rule breakdown and the person who signed it.

• Policy changes ship as a new rule-set version, so past decisions keep their original scoring instead of being silently rewritten.

• Golden-file tests fail loudly when a rule change moves a score that was not meant to move.