Plan-level correlation
What it does
Catches multi-step chains that are harmful together, such as create a payee then pay it.
It keeps a per-session history of resolved actions and flags a chain of individually-legal steps that are harmful together, holding the sequence for review.
When it applies
Across a session, on multi-step chains of actions.
How it works
The gateway keeps per-session history of resolved actions, so it can catch a chain of individually-legal steps that are harmful together, which no single-call check can detect.
In practice
An agent registers a new supplier and then pays it in the same session; each step is legal alone, but the sequence is flagged as invoice-fraud shaped.
What you get
The correlated chain is recorded so the multi-step pattern is visible after the fact.
Why it matters
Stops invoice-fraud sequences no single-call check can see.
Some attacks are only harmful in combination, each step is individually legal. Plan correlation catches the chain, such as creating a payee and then paying it, that no single-call check can see.