# How a DIT decision is made

## How a DIT decision is made
DIT runs a series of evaluations across **trust components** (Identity, Address, DOB, SSN, Phone, Email, Device). Each component returns a `Yes` / `No` trust verdict and a set of reason codes that explain it. The overall recommendation is computed from those verdicts:
| Recommendation | When it's returned |
|  --- | --- |
| **Approve** | Both Identity Trust **and** Address Trust are `Yes`, **and** at least one other component (Phone, Email, SSN, …) is also `Yes`. DOB Trust is **not** part of this rule — it only feeds Identity Trust. |
| **Review** | Identity Trust **and** Address Trust are **both** `Yes`, but **no** other component is trusted. |
| **Deny** | Identity is `No` or Address is `No`. The other components are ignored — neither phone nor email evidence can compensate for a failed identity or address result. |


```
                   Identity Trust = Yes ?
                        │
              ┌─────────┴─────────┐
              No                  Yes
              │                   │
            Deny           Address Trust = Yes ?
                                  │
                       ┌──────────┴──────────┐
                       No                    Yes
                       │                     │
                     Deny           Any other trust = Yes ?
                                              │
                                  ┌───────────┴───────────┐
                                  No                      Yes
                                  │                       │
                               Review                  Approve
```

Version: v3

## Description:

  - `How a DIT decision is made` ()
    DIT runs a series of evaluations across trust components (Identity, Address, DOB, SSN, Phone, Email, Device). Each component returns a Yes / No trust verdict and a set of reason codes that explain it. The overall recommendation is computed from those verdicts: RecommendationWhen it's returnedApproveBoth Identity Trust and Address Trust are Yes, and at least one other component (Phone, Email, SSN, …) is also Yes. DOB Trust is not part of this rule — it only feeds Identity Trust.ReviewIdentity Trust and Address Trust are both Yes, but no other component is trusted.DenyIdentity is No or Address is No. The other components are ignored — neither phone nor email evidence can compensate for a failed identity or address result. Identity Trust = Yes ?
                        │
              ┌─────────┴─────────┐
              No                  Yes
              │                   │
            Deny           Address Trust = Yes ?
                                  │
                       ┌──────────┴──────────┐
                       No                    Yes
                       │                     │
                     Deny           Any other trust = Yes ?
                                              │
                                  ┌───────────┴───────────┐
                                  No                      Yes
                                  │                       │
                               Review                  Approve
                   Identity Trust = Yes ?
                        │
              ┌─────────┴─────────┐
              No                  Yes
              │                   │
            Deny           Address Trust = Yes ?
                                  │
                       ┌──────────┴──────────┐
                       No                    Yes
                       │                     │
                     Deny           Any other trust = Yes ?
                                              │
                                  ┌───────────┴───────────┐
                                  No                      Yes
                                  │                       │
                               Review                  Approve