Alloy release round-up: October 2026

Featuring AI summaries you can tune yourself, richer counterparty data for transaction monitoring, and dynamic comparisons that work every way you need them

A theme that has been building all year kept going in October: more of what used to require a request to Alloy is now something you can do yourself. You can now shape how your AI Analysis reads without filing a ticket. Transactions now carry a much richer picture of who is on the other side of them. And a long list of threshold combinations that used to be off-limits in the workflow editor now simply work.

Customize your AI Analysis 

Once customers had AI Analysis summaries running, the most common follow-up we heard was about how they read: shorter, longer, or as a list. Each of those used to mean reaching out to us, and we’d customize it for you. Now you can customize to your heart’s content, all within the product.

A new Settings → AI Analysis page gives you two controls, with a live preview before you save:

• Length: Short gives you the overall assessment and the finding that drives it, in about 40 words. Medium is today's summary, unchanged. Long walks through how the signals relate and where they conflict, with every relevant finding, in about 200 to 250 words.
• Format: Default, which reads as a paragraph, or Bullets-only.

You never see or edit a prompt. You pick an option, and we turn it into instructions that we write and maintain. The setting applies across Evaluation, Journey Application, Entity Application, and Investigation summaries. Every account starts on today's defaults, so nothing changes until you choose otherwise, and existing summaries are never regenerated. Two new role permissions control who can view and change the setting.

Richer counterparty data for transaction monitoring

Who is on the receiving end of a transaction matters as much as who initiated it. Until now, every counterparty had to fit a single entity-plus-bank-account shape, which never quite worked for a card purchase and made some important fraud patterns difficult to express.

Now you can capture a counterparty's identity separately from the instrument they used, whether that's a bank account or a card, and attach devices to that identity. One identity can hold several instruments, and one instrument can be shared across identities. That gives you room for rules like:

• Card-testing detection on card-based transactions.
• "How many distinct identities have used this card in the last 30 days?"
• Device-aware rules on the counterparty side of a transaction.

All of it is available through aggregations on the transaction object. There's nothing to turn on: Alloy builds the richer model from the shape of the counterparty data you already send in your events request. Your existing counterparty logic keeps working exactly as it does today.

Dynamic comparisons that work every way you need them

Some of the most useful thresholds don't compare a value to a fixed number. They compare two values from the same evaluation: an output attribute against an input attribute, say, or one matrix model's result against another's. That's a dynamic comparison, and it's how you express rules like "flag this when the stated income is higher than the verified income."

Until now, many combinations weren't supported, so the workflow editor wouldn't let you put an output attribute, a matrix model, or an imported value on either side of one. We've rebuilt how the evaluation engine handles these, and every combination now works:

• Output attributes and imported output attributes
• Matrix models and imported matrix models
• Input attributes and service attributes
• Outcome reasons

If you've had a dynamic threshold you couldn't configure, or one that didn't behave the way you expected, that should be smoother now.  This has been one of the more common requests we've heard from policy teams, and we're glad to close it out.

Also shipped in October 2026

Experience

• The new navigation has been turned on for all accounts. The redesigned sidebar we introduced in July is now on for every Alloy customer as of October 29, with a few additions: every top-level page has a consistent header with a short description of what it's for, Settings gets its own collapsible sub-navigation, the account switcher has moved to the top left, and your profile and log out now sit at the bottom left. Nothing about how Alloy works has changed, and a short product tour walks you through it the first time you log in.

Decisioning

• Test for the unexpected with Error Attributes in sandbox. Your workflow works great when every service responds. But what happens when one times out, hits a rate limit, or throws an authentication error? Sandbox profiles now support Error Attributes, so you can find out safely before it matters. Create a new profile or add to an existing one, select a service, choose an error attribute, set the value, and run sandbox evaluations against it.
• Published Attributes for bank accounts and devices. Persist custom attributes directly on bank accounts (including external accounts) and on devices, then read or update them through workflow input and output attributes. Those values carry forward to later events, so a risk signal about a device or account informs every decision that touches it. Device attributes can be scoped to a single entity or shared globally, which is a natural fit for risk-based authentication. Create both in Settings → Published Attributes, same as any other attribute type.
• More flexible, more explainable login aggregations. Login aggregation rules can now filter on published attributes and device details, and support a new not in operator. When a login or aggregation rule fires, the evidence behind it is now shown alongside the decision.
• Aggregations in Portfolio Evaluations. Aggregation-based rules now work in Portfolio Evaluations, so portfolio-level testing uses the same decisioning you run everywhere else.

Application review

• Start Review and Next Application. Move straight from one application into the next without bouncing back to the queue.
• Claim on open. Opening an application assigns it to you, so two reviewers don't end up working the same case.
• Bulk unassign. Release a batch of applications back to the queue in one step, with a confirmation so it's never an accident.

New integrations

• Twilio Lookup: phone intelligence from Twilio, with selectable data packages so you only pull what your policy needs.
• Trulioo Business (KYB) Monitoring: ongoing registry monitoring for the businesses you onboard, so changes surface after day one.
• LexisNexis in the Alloy OTP plugin: LexisNexis is now available as a provider for one-time passcodes in the Alloy SDK.
• ValidiFI vAccount+ Verify with AOA: bank account verification and ownership authentication in a single call. You learn whether an account is open and valid, how likely it is to come back as NSF or closed, and whether the applicant is the verified owner of the record. Useful before funding or ACH origination, for stopping account takeover fraud, and as a signal in credit underwriting.

Integration updates

• DataZoo: expanded coverage across APAC and Peru.
• Prove: Instant Auth now supports a challenge question (date of birth, SSN, or last four of SSN), and Mobile Auth sets an authentication status when an attempt errors.
• Equifax OneView: the PDF combo indicator is now configurable on soft pulls.
• ComplyAdvantage: pass your own external identifier through from the request payload.
• Zest: TransUnion bureau data is now available.
• Multi-document capture: now available in Swedish and Norwegian.

API and webhooks

• External entity IDs in more webhooks. Transaction status and manual review webhooks now include your external entity IDs, so you can match events to records in your own systems without an extra lookup.
• Application status in the Diagnostics API. The journey application timings endpoint now returns the application's status alongside its latency breakdown.
• Canadian addresses. State fields now accept Canadian province and territory codes.