For product-led growth teams

The rules are already there, just scattered

Every PLG team has signup rules. They live in a Zapier filter, an if in the signup handler, a sheet of blocked domains and a Slack thread about that one competitor. None of it is versioned, so nobody can say when a rule changed, and none of it is measured, so nobody can say whether blocking Gmail last quarter cost paying customers.

One call, your rules

// in your signup handler
const d = await fetch("https://api.sortance.com/v1/decide", {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.SORTANCE_KEY}`, "Content-Type": "application/json" },
  body: JSON.stringify({ email, context: { purpose: "signup", attributes: { plan_selected: plan } } }),
}).then((r) => r.json())

switch (d.decision) {
  case "allow":           return createAccount(email, { sortanceTraceId: d.trace_id })
  case "allow_with_flow": return redirectToFlow(d.flow)       // e.g. "agent" → API-key onboarding
  case "review":          return queueForReview(email, d.reasons)
  case "challenge":       return requireExtraStep(email)
  case "deny":            return politelyDecline(d.rule_id)
}

The policy behind it is written in English — “no temp emails, agents go to the API-key flow, review anyone outside our industries” — compiled once into rules you can read, and replayed over your recent signups before it touches a real one. See Decide.

Agents are a flow, not a block

An AI agent signing up for your product may be exactly the customer you want, arriving through the wrong door. Sortance classifies the mailbox (actor_class: "agent_mailbox"), and a rule like allow_with_flow("agent") sends it to your API-key onboarding instead of an email-verification loop it cannot finish. See agent mailboxes.

Measure the rule against revenue

• Shadow first. Run a new rule on every signup without enforcing it, and see what it would have done.
• Then split traffic. 80/20, scored on subscribed, with no verdict until the minimum sample is reached. See experiments.
• Let Stripe report the outcome. Connect it and paid conversion is joined to the signup decision automatically. See Stripe.

What it will not do to your funnel

• Break signup. A vendor outage or a missing policy still returns 200 with a decision — your default action, which is allow unless you chose otherwise.
• Deny on its own. Only a rule you confirmed can deny, and the response names it. Rules that depend on enrichment lean to review, because missing data should not become a lost signup.
• Replace your auth. Your app still owns the form, the session and the one-time code. Sortance answers “should this email proceed”.

The numbers to watch