RAFP enforces who can act.
RAFP+ determines whether they should.
The most dangerous withdrawal requests are technically valid — correct signature, legitimate account, approved permissions. RAFP+ detects the behavioral signals that rules can't see.
Stolen API keys, hijacked accounts, abused automation — these generate correctly signed, fully authorized requests that pass every rule check.
A request can clear every policy gate and still be an attack. The signature was valid. The permissions were correct. But the behavior was not.
Traditional rule-based systems evaluate each request in isolation — they have no memory of what normal looks like, and no visibility into patterns that only emerge across accounts or over time. That's the gap RAFP+ closes.
Preview the full RAFP+ scenario.