Validator Checks

Solidity Example

(bytes32 policyId, bytes memory attUID, bytes32 expectedEpochRoot, uint256 maxKycAge) =
    abi.decode(rule, (bytes32, bytes, bytes32, uint256));

(bool ok, uint32 reason) = policyEngine.isEligible(
    msg.sender,
    abi.encode(policyId, attUID, expectedEpochRoot, maxKycAge)
);

require(ok, string(abi.encodePacked("KYC_DENIED:", _toString(reason))));

Inside PolicyEngine

function _checkFreshness(
    uint64 kycVerifiedAt,
    uint64 sanctionsEpoch,
    uint64 latestEpoch,
    uint256 maxAge
) internal view returns (bool ok, uint32 reason) {
    if (block.timestamp - kycVerifiedAt > maxAge) {
        return (false, 2001); // STALE_KYC
    }
    if (sanctionsEpoch < latestEpoch) {
        return (false, 1001); // STALE_SANCTIONS
    }
    return (true, 0);
}