
Treat a wrong contractor TIN as an immediate control decision, not a later data fix. Classify each case as missing TIN, obviously invalid TIN, or CP2100/CP2100A mismatch, then follow the correct branch with dated ownership. For matched IRS notices, send the notice package within 15 business days and begin withholding no later than 30 business days after receipt; apply 24% when withholding is required. Maintain payee history so any repeat listing within three years moves to second-notice documentation standards.
If you issue Forms 1099 or other information returns, treat a TIN problem as a potential withholding event, not just a data-cleanup task. The IRS ties the B-notice program to Treasury Regulation 31.3406(d)-5 and IRC 3406(a)(1)(B). Your process needs defensible payer actions when a notice arrives or a TIN is missing.
Two triggers matter right away. The IRS says you should begin withholding immediately if a payee refuses or fails to provide a TIN, or if the TIN provided is obviously incorrect. Separately, 26 USC 3406(a)(1)(B) treats IRS notice that a furnished TIN is incorrect as a trigger. The current rate is 24 percent.
In practice, the operational signal is a CP2100 or CP2100A notice. The IRS says these notices mean the payee name and TIN on an information return is missing or does not match IRS records, and CP2100A applies when you filed fewer than 50 information returns with errors. Start intake by confirming the notice type, logging the receipt date, identifying affected payee records, and classifying each issue as a missing TIN, an obviously incorrect TIN, or an IRS-reported name/TIN mismatch.
This guide is for compliance, legal, finance, and risk owners who need aligned decisions under time pressure. Compliance needs the right notice path, finance needs a clear withholding status, legal needs the policy basis, and risk needs visibility across payees.
The goal here is practical. Turn notice events into concrete actions, evidence, and escalation points that align with Publication 1281. That includes separating first-notice and repeat-notice handling. The IRS treats the repeat-notice path as applying when a payee is listed on CP2100 or CP2100A a second time within a three-year period, so payee-level history tracking is a core control.
Operational discipline is critical in cases involving a missing TIN, an obviously incorrect TIN, or an IRS mismatch notice. At minimum, keep a clear record of notice receipt, affected payee identity, outreach history, Form W-9 status, and when withholding was started, reviewed, or stopped.
Use this list when CP2100/CP2100A handling needs to be repeatable, documented, and consistent across teams, not managed ad hoc in inboxes.
This is a strong fit for payer teams where TIN mismatch work crosses compliance, finance, support, and operations. If notice volume is meaningful, your model should reliably compare each IRS notice line to payer records, send the appropriate B notice when records match, and preserve payee history so you can distinguish a first listing from a second listing within the three-year period.
If your reportable payee count is very small and tax operations ownership is unclear, clarify ownership before you make tooling decisions. Breakdowns to watch for include notice intake without a clear withholding decision record, no clear Form W-9 recollection trail, and no documented history of actions taken.
For each affected payee, your checkpoint is one complete record: notice receipt date, record-comparison result, outbound first B notice with Form W-9 when applicable, and TIN solicitation history. IRS guidance requires up to three TIN requests: initial, first annual, and second annual. Choose the model that makes that sequence, and the evidence trail behind it, the default. If you want a deeper dive, read Bad Payouts Are Costing You Supply: How Payout Quality Drives Contractor Retention.
Lock down this trigger map before you make tooling decisions. For each event, decide whether to start withholding now or move into a documented notice or remediation branch.
| Trigger | Start withholding now? | Required payer action | Why this branch is different |
|---|---|---|---|
| Missing or refused Taxpayer Identification Number | Yes | Start withholding immediately and log TIN solicitation history. | Missing TIN is a direct withholding trigger. |
| TIN is obviously incorrect (not 9 digits or contains non-numeric characters) | Yes | Start withholding immediately and log the correction path. | Obvious TIN invalidity is an immediate-start trigger. |
| CP2100 or CP2100A notice line matches your records | Not immediate by default; follow notice timing rules | Send the appropriate B notice and track timing, including the 30th business day point for incorrect name/TIN notice handling. | This is an IRS notice workflow, not routine data cleanup. |
| CP2100 or CP2100A notice line does not match your records | No | Correct or update your records and document what was changed. | IRS guidance treats this as a records-correction path. |
| Potentially incorrect name/TIN found internally or through TIN matching (without IRS notice) | No, by itself | Collect remediation evidence, fix records, and determine whether an IRS notice exists. | TIN-matching output is not itself the legal incorrect-TIN notice trigger under §31.3406(j)-1. |
Make two branches explicit in your table notes. A first CP2100/CP2100A listing requires a First B Notice with Form W-9. A second notice within three calendar years requires the second-notice branch.
Use one case file per payee: notice receipt date, record-comparison result, branch selected, outbound notice record, and current withholding status. Keep "start withholding now" events separate from "collect remediation evidence" events so compliance and finance are not blocking each other.
For policy defensibility, anchor the map to Treasury Regulation 31.3406(d)-5 for notice mechanics and timing, and IRC 3406(a)(1)(B) for IRS notice of an incorrect TIN as a withholding trigger. For related IRS notice context, see How to Handle an IRS Notice of Deficiency (90-Day Letter).
Take discretion out of the start decision. Use trigger-based rules so teams do not wait for contractor replies before acting.
| Trigger | Start withholding? | Required timing/action |
|---|---|---|
| No TIN furnished | Yes, at 24% | Start immediately on reportable payments; record solicitation history, detection date, and effective start date. |
| TIN is obviously incorrect (not 9 digits or includes an alpha character) | Yes, at 24% | Treat as an invalid-TIN start condition, not a cleanup queue item. |
| CP2100/CP2100A line matches what you filed | Yes, through the notice workflow | Send the required notice and Form W-9 within 15 business days, from notice date or receipt date, whichever is later, and start withholding no later than 30 business days after receipt. |
For CP2100/CP2100A, treat the line-item match as the decision point. Once matched, run the notice workflow against dated deadlines and named ownership. This is not routine data cleanup.
The IRS does not prescribe your internal approval design, so set one explicitly. Define who can activate withholding and who can remove it. If you want tighter controls, use dual confirmation for removal after a TIN-mismatch case, with supporting evidence and dates, for example a received Form W-9 and receipt date.
Add a reconciliation checkpoint before each Form 1099 population is finalized. Confirm every reportable payee has a coherent withholding status, effective dates, and mismatch-case state. If a reportable payee has missing start or stop evidence or an unresolved CP2100/CP2100A status, treat it as an internal control break.
Related: When Platforms Are Responsible for Contractor Tax Fraud or Money Laundering.
A manual queue can work, but only if deadlines, ownership, and evidence are fixed in the process rather than left to judgment.
Use manual effort for record matching and document review, but treat CP2100/CP2100A timing triggers as fixed. For incorrect TIN cases, compare the IRS notice list to what you filed. If they match, send the appropriate notice.
One common failure mode is deadline drift. Cases sit in inboxes or batching cycles and miss the 15-business-day mailing window.
Another failure mode is repeat listings. A second listing within three years is a repeat-notice case, and another W-9 alone is not sufficient. The payee must provide stronger third-party documentation, for example a Social Security card copy or Letter 147C.
Calendar-driven TIN solicitations can also be missed. The sequence is up to three requests: initial, first annual, and second annual. If the TIN is still missing after the first annual solicitation, the second annual solicitation is due by December 31 of the following year.
As an internal operating pattern, a low-volume team may assign one analyst to CP2100A intake, line-item reconciliation, notice plus Form W-9 mailing where records match, and dated checklist logging for every case. Keep supervisor review for repeat listings and any decision to stop withholding. If cases start missing the 15-business-day mailing window or annual solicitations are tracked outside the main case log, manual handling is no longer controlled.
This option works when your volume is growing and you want to prevent avoidable name/TIN errors before filing, while keeping full notice procedures for issues the IRS raises later.
IRS TIN Matching is a pre-filing service for eligible payers and authorized agents. It validates name/TIN combinations against IRS records before information returns are submitted, so it fits naturally at onboarding when you already collect Form W-9 data.
The practical benefit is catching preventable data problems earlier. You can also screen for obviously incorrect TIN formats, for example anything other than nine digits or anything containing an alpha character. Cleaner intake data can reduce downstream CP2100/CP2100A cleanup work.
This model works best if exception handling is part of onboarding, not a side inbox. A practical control is to capture Form W-9 first, run matching on that legal name and TIN, and route unresolved exceptions to payer compliance before final clearance. Blocking payouts at that stage is an internal control decision, not an IRS-stated requirement.
At minimum, keep these fields in each exception case:
A TIN matching result is not an IRS incorrect-name/TIN notice for withholding purposes. So onboarding matching helps reduce bad filings, but it does not replace notice obligations.
If the IRS later issues CP2100/CP2100A, your notice flow still controls. Begin withholding immediately when required. Send the first notice with Form W-9 for first listings, and treat a repeat listing within the three-year period as a second-notice case where a new W-9 alone is not enough, for example a Social Security card copy or Letter 147C.
Related: Accounts Payable Outsourcing for Platforms When and How to Hand Off Your Payables to a Third Party.
Use this model when you need automation for CP2100/CP2100A volume but still need human judgment on higher-evidence mismatch cases. It fits multi-market platforms that already run onboarding checks and want tighter post-notice control without treating every case as fully manual.
The rule is simple: systems sort and route, and people decide when the evidence supports a withholding change. After a CP2100/CP2100A event, you may need to begin withholding. For missing or obviously incorrect TINs, backup withholding begins immediately; for incorrect name/TIN notice cases, follow the notice timeline. Publication 1281 lists the rate at 24%, so these decisions need clear controls and records.
Option 2 improves pre-filing data quality. Option 3 keeps that layer and adds policy gates for post-filing events where first versus second notice handling matters.
TIN Matching still helps, but it is a pre-filing service. It does not replace CP2100/CP2100A and B-notice procedures, including repeat listings within the three-year period. In practice, a hybrid flow can auto-open CP2100/CP2100A cases, classify first versus repeat listings, start the First B Notice 15-business-day clock, and route stricter-evidence cases for reviewer decisions. That may include second-notice scenarios involving a Social Security card copy or IRS Letter 147C for EIN verification.
You do not need complex tooling. You do need explicit checkpoints such as:
A common failure is splitting annual solicitation tasks away from the case record. Publication 1281 says a notice sent in response to CP2100/CP2100A satisfies the annual solicitation requirement for incorrect TIN penalty relief. Teams still need ownership for open missing-TIN cases and for second annual solicitation timing by December 31 of the following year, where applicable.
Each case should be defensible without reconstructing inbox history. Keep, at minimum, the notice identifier, filed name/TIN, W-9 on file, corrected W-9 versions, first versus second listing status within three years, notice send date, remediation documents received, and the withholding decision with timestamp.
For repeat-notice EIN paths, record whether IRS Letter 147C was received. For individual mismatches in that same path, record whether a Social Security card copy was received. Avoid generic labels like "verification received" when the proof standard is different.
| Model | Implementation speed | Control depth | Audit traceability | Staffing load | Failure containment |
|---|---|---|---|---|---|
| Option 1 manual queue | Fastest to launch | Moderate | Depends on analyst discipline | Higher per case | Weak if deadlines or evidence logs slip |
| Option 2 onboarding matching | Moderate | Good before filing, lighter after notice receipt | Strong for intake records, weaker for post-notice decisions | Lower day to day, but exception ownership still needed | Good for preventable mismatches, weaker for repeat notice cases |
| Option 3 hybrid gates and logs | Slower to design | Highest across intake and post-notice decisions | Strongest if every decision and artifact stays in the case record | Moderate, with humans focused on escalations | Best at containing repeat-notice and withholding-stop errors |
With engineering support, this is often the steadiest long-term operating model. The value is that IRS triggers, Publication 1281 timelines, and evidence-based review decisions stay in one audit-ready record. Need the full breakdown? Read Continuous KYB for Platforms Without Full Re-Onboarding.
To make first-notice handling defensible, run it as a timed compliance process: reconcile the IRS notice, send the required package on time, and stop withholding only after the required certification is received.
| Step | Requirement | Timing |
|---|---|---|
| Reconcile listing | Compare the CP2100/CP2100A listing with your records and confirm whether the filed name/TIN is missing, mismatched, or obviously incorrect. | Before outreach |
| Send First B Notice package | Send the First B Notice and Form W-9, with an optional reply envelope. | Within 15 business days from the notice date or receipt date, whichever is later |
| Validate Form W-9 response | Accept only a Form W-9 or substitute that includes name and TIN and is signed and dated under penalties of perjury. | Keep the case open if the response is unsigned, incomplete, or inconsistent |
| Start backup withholding | Apply backup withholding by the notice timeline, not by payee response pace. | No later than 30 business days after CP2100/CP2100A receipt; immediately if the payee refuses or fails to provide a TIN |
| Stop withholding | Stop withholding only after required certification is received and confirmed. | Within 30 calendar days after receiving Form W-9 |
Compare the IRS listing with your records first. For each affected payee, confirm whether the filed name/TIN is missing, mismatched, or obviously incorrect. A TIN is obviously incorrect if it is not exactly nine digits or includes a letter, and those cases may require prompt withholding action.
For first listings, send the First B Notice and Form W-9, with an optional reply envelope, within 15 business days from the CP2100/CP2100A notice date or receipt date, whichever is later. Treat the W-9 as required, not optional, and document what was sent and when.
A valid Form W-9, or substitute, must include name and TIN and be signed and dated under penalties of perjury. If a response is unsigned, incomplete, or still inconsistent with the record, keep the case open until required certification is received.
Start withholding no later than 30 business days after CP2100/CP2100A receipt, and begin immediately if the payee refuses or fails to provide a TIN. The rate is 24%, so payment-system status should match the compliance decision.
After receiving required certification (Form W-9), stop withholding within 30 calendar days. Treat repeat listings separately, since Second B Notice handling applies when a payee is listed again within a three-year period.
Operational misses such as late notices, missing W-9s, or stopping withholding before required certification can increase payer liability risk.
For a broader IRS notice-response walkthrough, see How to Handle an IRS CP2000 Notice (Underreported Income).
If your team is formalizing CP2100/CP2100A handling, review Gruv docs to map decision trees, status tracking, and audit-ready event records into your existing workflow.
A Second B Notice is a different workflow, not a repeat of First B Notice handling. If the same payee appears again on a CP2100/CP2100A within the three-year lookback period, treat it as a second-notice case immediately. The cure standard is stricter, and a new Form W-9 alone is not enough.
| Control point | Requirement | Key detail |
|---|---|---|
| Three-year lookback | If the current CP2100/CP2100A falls within three years of the prior name/TIN mismatch notice for that payee, treat it as a Second B Notice. | Keep the prior notice reference and date comparison in the case file |
| Validation standard | After a second notice, a certified Form W-9 by itself cannot stop or prevent withholding. | Obtain name/TIN validation from SSA or IRS; for EIN mismatches, IRS verification documentation such as Letter 147C |
| Escalation gate | Route second-notice cases to compliance review as an internal control, without delaying required actions. | Send the Second B Notice within 15 business days; if the TIN is missing or obviously incorrect, begin withholding immediately at 24% |
| Exception register | Track second-notice cases separately. | Log prior and current notice dates, the three-year trigger result, validation document status, withholding status, and outcome |
Confirm whether the current CP2100/CP2100A notice falls within three years of the prior name/TIN mismatch notice for that payee. If yes, route it as a Second B Notice before sending routine first-notice outreach. Keep the prior notice reference and date comparison in the case file.
After a second notice, a certified Form W-9 by itself cannot stop or prevent withholding. The payer must obtain name/TIN validation from SSA or IRS. For EIN name/TIN mismatches, obtain IRS verification documentation such as Letter 147C.
If second-notice criteria are met, route the case to compliance review as an internal control. This is not an IRS-required approval step, and it should not delay required actions. Keep statutory timing intact: send the Second B Notice within 15 business days, and if a TIN is missing or obviously incorrect, begin withholding immediately at 24%.
As an internal control, log second-notice cases with prior and current notice dates, the three-year trigger result, validation document status, withholding status, and outcome. This helps surface repeat failures and detect control breaks early.
Year-end surprises can come from calendar drift. Put annual-solicitation work on a dated control schedule tied to your filing and recipient-statement calendar so unresolved TIN cases are visible before deadline week.
| Control | What to track | Key deadline/reference |
|---|---|---|
| Annual solicitation schedule | Track the account-open date, CP2100/CP2100A receipt, solicitation dates, and whether Form W-9 was returned. | If no TIN is received after the first annual solicitation, the second annual solicitation is due by December 31 of the year following the calendar year the account was opened |
| Filing-calendar tie-in | Map open cases against filing and furnishing dates before records move into production output. | Form 1099-NEC: January 31; Form 1099-MISC: February 28 paper / March 31 electronic; include W-2G |
| Checkpoint report | Keep one report showing open TIN mismatch cases, missing Form W-9 responses, and withholding status. | Use Publication 1586's comparison of the IRS payee listing to your records; use the make-up solicitation path in Publication 1586 if annual solicitations were missed |
Calendar Publication 1281 annual-solicitation duties end to end. For incorrect TIN cases, Publication 1281 requires up to two annual solicitations in response to a CP2100/CP2100A notice. If no TIN is received after the first annual solicitation, set a hard deadline for the second annual solicitation: December 31 of the year following the calendar year the account was opened. Track the account-open date, CP2100/CP2100A receipt, solicitation dates, and whether Form W-9 was returned.
Tie solicitation status to your information-return and furnishing calendar. Do not wait until file-generation week to surface open TIN issues. Map open cases against form-specific due-date pressure points, including Form 1099-NEC (January 31) and Form 1099-MISC (February 28 paper / March 31 electronic), and include forms covered by the general instructions, such as W-2G. Because filing and furnishing obligations both apply, route unresolved mismatch or missing-W-9 cases to compliance review before records move into production output.
Run a standing checkpoint report and reconcile to IRS listings. Keep one report showing open TIN mismatch cases, missing Form W-9 responses, and withholding status. Use Publication 1586's comparison of the IRS payee listing to your records as the reconciliation control so exceptions stay visible. If required annual solicitations were missed, document the gap and use the make-up solicitation path described in Publication 1586.
If you cannot reconstruct a name/TIN case quickly, you do not control it. Set one minimum evidence standard for every CP2100 and CP2100A case, then run governance from that file.
Every case should include the CP2100 or CP2100A listing entry, your comparison of that listing to internal payer records, proof of the first or second notice sent, the payee response artifacts, and the final payer decision. If the IRS notice and your records match, send the appropriate notice and document that step.
Keep the file focused on decision traceability. For a first notice, the response artifact is a properly completed and signed Form W-9, or acceptable substitute. For a second notice, do not treat another W-9 as sufficient. Capture stronger proof, for example a Social Security card copy or IRS Letter 147C. If mail is returned, retain the undelivered notice in the case record for 3 years.
Treat Form W-9 as payer-held evidence: it is given to the requester and not sent to the IRS by the payee. Limit internal exposure of W-9 data to what each role needs.
If your organization is covered by the FTC Safeguards Rule (16 CFR 314.4), restrict access to authorized users based on job need. When you review a case, confirm the W-9 is signed, legible, tied to the correct payee, and linked to the exact notice cycle that triggered collection.
Set a defined internal review cadence and test a sample of recent cases for four controls: notice-to-record match, correct notice type, complete payee evidence, and withholding status that matches the facts.
Escalate repeat name/TIN failures and unresolved withholding as high risk. For second-notice cases, verify timing against the 30 business days window after the Second B Notice date. Do not stop withholding after a second notice based only on a new W-9 if the required proof is still missing.
Report a small set of operational metrics from case evidence: open-case aging, repeat payee failure rate, and payees still in unresolved withholding at the current 24 percent backup withholding rate.
These metrics are governance choices, not IRS-required KPI formats. Where FTC Safeguards coverage applies, use the same evidence to support required safeguard testing, monitoring, and written reporting to the board or equivalent governing body at least annually. Related reading: How to Automate W-9 Collection for a 1099 Contractor Pool.
If you only get four things done this month, focus on ownership, trigger logic, evidence standards, and one adjacent Form 8233 control review. That gives you a defensible payer process without trying to automate every edge case at once.
Choose your model, manual queue, TIN matching with exceptions, or hybrid, then assign one accountable owner each in compliance, finance, and operations. Make ownership explicit for CP2100/CP2100A intake, withholding activation, and payee communications. A practical split is that compliance handles notice classification and first- or second-notice decisions, finance handles withholding status and reporting alignment, and operations handles outbound notices, response tracking, and document intake.
Your table should cover CP2100/CP2100A receipt, missing TIN, First B Notice, and Second B Notice, with action and timing for each. Keep the timing rules explicit: Publication 1281's 15-business-day window for the first-notice package, from notice date or receipt date, whichever is later, and Treasury Regulation 31.3406(d)-5's withholding start point after the close of the 30th business day after notice receipt for incorrect name/TIN notice cases. Make branch logic explicit as well: missing TIN or refusal or failure to provide TIN means immediate withholding; if IRS notice data matches your records, send the appropriate notice; if the same payee is listed again within three years, route to repeat-notice handling. Anchor the policy note to Treasury Regulation 31.3406(d)-5 and IRC 3406(a)(1)(B).
Define "complete file" now so each case is defensible: notice receipt date, match check against payer records, outbound first or second notice copy, Form W-9 or required stronger evidence, decision log, and withholding status history. Add one recurring control before each information-return filing cycle to reconcile open mismatch cases against current withholding flags. For second-notice Name/TIN remediation, name acceptable evidence explicitly, such as an IRS Letter 147C or a Social Security card copy, not a generic "updated tax form."
If you pay nonresident alien individuals for qualifying personal services, verify Form 8233 controls in the same 30-day window. The withholding agent must review, sign, and forward an accepted Form 8233 to the IRS within 5 days, and separate forms are required by tax year, withholding agent, and income type. If your B-notice and Form 8233 workflows show the same documentation or status-tracking gaps, tighten them together under one document-handling standard. For deeper detail, see IRS Form 8233: When Foreign Contractors Claim Treaty Exemptions and What Platforms Must Verify.
Related: What Is Dynamic Discounting? How Platforms Can Offer Early Payment to Contractors for a Discount.
When you are ready to pressure-test your trigger map and evidence pack against real payout operations, talk with Gruv.
An IRS B-notice workflow is triggered when a CP2100 or CP2100A shows a missing TIN or a name/TIN mismatch against IRS records. The program also applies when a TIN is missing or obviously incorrect, which can require withholding right away. Before acting, match the IRS listing to your payer record so you handle the correct payee.
Start withholding immediately if no TIN was provided or the TIN is obviously incorrect. IRS CP2100/CP2100A guidance also says to begin withholding immediately for missing or obviously incorrect TINs if you have not already. The current rate is 24 percent.
A First B Notice is the first notice event for that payee after CP2100/CP2100A and must include Form W-9. A Second B Notice applies when the same payee is listed again within a three-year period, and another W-9 alone is not sufficient. For a second notice, the payee must provide stronger documentation, such as a Social Security card copy or IRS Letter 147C.
To stop withholding, the payee must provide the correct TIN to the payer. In first-notice cases, a properly completed W-9 that provides the correct TIN may be enough. In second-notice cases, do not stop withholding based only on a new W-9 if the required higher-grade documentation is still missing.
For missing-TIN cases, you must make up to three requests: initial, first annual, and second annual solicitations. If the TIN is still missing after the first annual step, Publication 1281 requires the second annual solicitation by December 31 of the year following the year the account was opened.
No. TIN matching helps you validate name/TIN combinations before filing information returns, but IRS guidance says matching results are not themselves a B-notice trigger. It reduces preventable errors, but it does not replace CP2100/CP2100A handling, annual solicitations, or withholding decisions.
There is no universal IRS rule that sets a single escalation threshold. Treat escalation as an internal risk and compliance decision, including whether second-notice documentation requirements are met before withholding is stopped.
Daniel writes about contractor classification, cross‑border hiring basics, and compliance-first operating models for global clients and independent contractors.
With a Ph.D. in Economics and over 15 years of experience in cross-border tax advisory, Alistair specializes in demystifying cross-border tax law for independent professionals. He focuses on risk mitigation and long-term financial planning.
Educational content only. Not legal, tax, or financial advice.

Payout issues are not just an accounts payable cleanup task if you run a two-sided marketplace. They shape supply-side trust, repeat participation, and fill reliability. They can also blur the revenue and margin signals teams rely on.

Form 8233 is used by nonresident alien individuals to claim exemption from withholding on compensation for personal services, but for platform operators the key exposure is often operational: scope decisions, review quality, recordkeeping, and escalation. When you pay nonresident individuals for U.S.-source personal services income, the real risk is often not whether a form exists, but whether your team can show why a claim was accepted.

Dynamic discounting is a buyer-led arrangement on outstanding invoices. Payment happens before the due date, and earlier payment usually means a larger discount. The core question is who funds that acceleration. In the standard model, the buyer uses its own cash, so your early-pay offer sits inside working-capital policy, not just product configuration.