Edge screening
Checks live at the boundary. Privacy lives inside the pool.
Status: design. XEROPAY is being built. These pages describe intended behaviour. Nothing here is claimed as live mainnet. Details can change. See What's live.
Shield and unshield can be checked so sanctioned flow stays out of the pool. Identity still belongs with licensed ramps — that KYC file is not supposed to sit next to note history.
Association sets
The edge can publish association sets so a withdrawal can prove it is not joined to known-tainted deposits — without revealing which notes you spent. That is how an issuer gets hygiene without a master viewing key.
Time-decorrelated exits
Withdrawals can be split and staggered so an unshield is harder to match to a shield by clock. Timing is a classic leak; the design treats it as one.
What screening cannot do
It cannot decrypt notes. It cannot freeze funds already inside except by refusing a later unshield. If a regulator needs a window into an account, that is a viewing key the holder issues — not a silent tap.