Financial agents need guardrails before executing trades, transfers, or credit decisions. Kairos is an open-source risk and fraud decisioning platform that sits between agent intent and execution. It provides the plumbing for real-time risk scoring, approval gates, and audit trails when agents trigger high-stakes actions.
The platform separates risk evaluation from execution. An agent calls Kairos with event data, Kairos runs decision graphs, and the agent receives a verdict: approve, deny, or escalate to human review. This architecture prevents agents from executing risky actions without explicit permission.
Decision Graph Architecture
Kairos structures risk logic as directed acyclic graphs (DAGs). Each node represents a rule, data enrichment step, or scoring function. Edges define dependencies and branching logic.
Key primitives:
- Event ingestion: Agents send JSON payloads describing the action (transfer amount, counterparty, account history).
- Rule nodes: Boolean conditions (e.g., "amount > $10,000" or "counterparty on sanctions list").
- Enrichment nodes: External API calls to fetch credit scores, device fingerprints, or transaction history.
- Scoring nodes: Aggregate risk signals into a numeric score.
- Decision nodes: Map scores to outcomes (approve, deny, manual review).
Graphs are versioned. When a rule changes mid-flight, Kairos can either pin the in-progress evaluation to the old version or abort and retry with the new ruleset. This prevents race conditions when agents trigger multiple evaluations in parallel.
Integration Patterns for Agents
Kairos exposes three integration modes:
| Mode | Latency | Use Case | Failure Handling |
|---|---|---|---|
| Synchronous API | 50-500ms | Real-time approval for low-volume agents | Agent blocks until verdict; timeout returns deny |
| Webhook callback | 100ms-5s | High-volume agents that can defer execution | Agent polls status endpoint or waits for webhook POST |
| Event stream | Variable | Batch processing or async workflows | Agent consumes from Kafka/Pulsar topic with decision results |
Most financial agents use the synchronous API. The agent makes a POST request with event data, Kairos evaluates the decision graph, and returns a JSON verdict:
{
"decision": "manual_review",
"score": 72,
"triggered_rules": ["high_velocity", "new_counterparty"],
"review_queue": "tier_2_fraud",
"decision_id": "dec_9x7k2m"
}
The agent halts execution and routes the request to a human queue. The decision_id links the agent's action to the audit trail.
Audit Trail and Provenance
Every decision generates an immutable audit record. Kairos stores:
- Input event payload
- Graph version and rule set
- Intermediate node outputs (enrichment data, partial scores)
- Final decision and timestamp
- Agent identity and session context
This provenance is critical for compliance. If an agent executes a fraudulent transfer, auditors can replay the decision graph with the original inputs to see which rules fired and why the action was approved.
Kairos writes audit logs to append-only storage (PostgreSQL with temporal tables or S3 with object versioning). Logs are indexed by decision ID, agent ID, and event type for fast retrieval.
Rule Engine Mechanics
Rules are expressed in a domain-specific language (DSL) or JSON schema. Example rule in JSON:
{
"rule_id": "velocity_check",
"condition": {
"and": [
{"field": "amount", "operator": ">", "value": 5000},
{"field": "transactions_last_hour", "operator": ">", "value": 3}
]
},
"action": "flag_for_review",
"weight": 25
}
Rules can reference enriched data. If a node fetches the user's credit score, downstream rules can branch on credit_score < 600.
Kairos compiles rules into an execution plan. It topologically sorts the graph, identifies parallelizable nodes, and generates a query plan for data fetches. This minimizes latency when evaluating complex graphs with dozens of rules.
Handling Mid-Flight Rule Changes
When a rule changes during an active evaluation, Kairos uses one of three strategies:
- Version pinning: Lock the evaluation to the graph version active when the event arrived.
- Abort and retry: Cancel the in-progress evaluation and restart with the new ruleset.
- Best-effort upgrade: Apply the new rule only to nodes not yet executed.
Version pinning is the safest default. It prevents inconsistent decisions when an agent triggers multiple evaluations in quick succession.
Observability and Failure Modes
Kairos exposes metrics for:
- Decision latency (p50, p99)
- Rule hit rate (which rules fire most often)
- Approval/deny/review ratios
- Enrichment API failures
Common failure modes:
- Enrichment timeout: External API (credit bureau, device fingerprinting) takes too long. Kairos can fail open (approve without enrichment) or fail closed (deny by default).
- Graph deadlock: Circular dependencies in the DAG. Kairos detects cycles at graph upload time and rejects invalid configurations.
- State drift: Agent retries a decision after the user's account state changed. Kairos can deduplicate by event ID or allow retries with fresh data.
Deployment Shape
Kairos runs as a stateless service. Decision graphs and rule definitions live in a PostgreSQL database. Audit logs go to S3 or a time-series database.
Typical deployment:
- API tier: Horizontally scaled pods behind a load balancer.
- Graph executor: Worker pool that evaluates decision graphs. Can scale independently from the API tier.
- Enrichment cache: Redis or Memcached to avoid redundant API calls for the same user/session.
For high-volume agents, Kairos can batch evaluations. Instead of one API call per event, the agent sends 100 events in a single request. Kairos evaluates them in parallel and returns an array of verdicts.
Security Boundaries
Kairos enforces two security layers:
- Agent authentication: API keys or OAuth tokens identify which agent is making the request. Agents can only trigger graphs they have permission to access.
- Data isolation: Multi-tenant deployments use row-level security in PostgreSQL to ensure one customer's decision graphs and audit logs are invisible to others.
Sensitive data (SSNs, account numbers) can be tokenized before sending to Kairos. The platform stores only the token, and enrichment nodes call a vault service to detokenize when needed.
Technical Verdict
Use Kairos when:
- You need a centralized risk decisioning layer for multiple agents or services.
- Compliance requires detailed audit trails with decision provenance.
- Your risk logic changes frequently and you want to decouple it from agent code.
- You have high-volume agents that need sub-second approval latency.
Avoid Kairos when:
- Your risk logic is simple enough to embed directly in the agent (e.g., a single threshold check).
- You need real-time streaming fraud detection with millisecond latency (Kairos is optimized for 50-500ms request/response).
- You already have a mature rules engine (Drools, FICO Blaze Advisor) and don't want to migrate.
Kairos shines when you have multiple agents (trading bots, payment processors, loan underwriters) that need consistent risk policies without duplicating rule logic in every codebase. The decision graph model makes it easy to visualize and test complex approval workflows before deploying them to production.
Top comments (0)