Kairos: How Open-Source Risk Decisioning Platforms Handle Real-Time Agent Approval Workflows
Financial agents need guardrails before executing trades, transfers, or credit decisions. Kairos is an open-source risk and fraud decisioning platform that sits between agent intent and execution. It provides the plumbing for real-time risk scoring, approval gates, and audit trails when agents trigger high-stakes actions.
The platform separates risk evaluation from execution. An agent calls Kairos with event data, Kairos runs decision graphs, and the agent receives a verdict: approve, deny, or escalate to human review. This architecture prevents agents from executing risky actions without explicit permission.
Decision Graph Architecture
Kairos structures risk logic as directed acyclic graphs (DAGs). Each node represents a rule, data enrichment step, or scoring function. Edges define dependencies and branching logic.
Key primitives:
- Event ingestion: Agents send JSON payloads describing the action (transfer amount, counterparty, account history).
- Rule nodes: Boolean conditions (e.g., "amount > $10,000" or "counterparty on sanctions list").
- Enrichment nodes: External API calls to fetch credit scores, device fingerprints, or transaction history.
- Scoring nodes: Aggregate risk signals into a numeric score.
- Decision nodes: Map scores to outcomes (approve, deny, manual review).
Graphs are versioned. When a rule changes mid-flight, Kairos can either pin the in-progress evaluation to the old version or abort and retry with the new ruleset. This prevents race conditions when agents trigger multiple evaluations in parallel.
Integration Patterns for Agents
Kairos exposes three integration modes:
| Mode | Latency | Use Case | Failure Handling |
|------|---------|----------|------------------|
| Synchronous API | 50-500ms | Real-time approval for low-volume agents | Agent blocks until verdict; timeout returns deny |
| Webhook callback | 100ms-5s | High-volume agents that can defer execution | Agent polls status endpoint or waits for webhook POST |
| Event stream | Variable | Batch processing or async workflows | Agent consumes from Kafka/Pulsar topic with decision results |
Most financial agents use the synchronous API. The agent makes a POST request with event data, Kairos evaluates the decision graph, and returns a JSON verdict:
{
"decision": "manual_review",
"score": 72,
"triggered_rules": ["high_velocity", "new_counterparty"],
"review_queue": "tier_2_fraud",
"decision_id": "dec_9x7k2m"
}
The agent halts execution and routes the request to a human queue. The decision_id links the agent's action to the audit trail.
Audit Trail and Provenance
Every decision generates an immutable audit record. Kairos stores:
- Input event payload
- Graph version and rule set
- Intermediate node outputs (enrichment data, partial scores)
- Final decision and timestamp
- Agent identity and session context
This provenance is critical for compliance. If an agent executes a fraudulent transfer, auditors can replay the decision graph with the original inputs to see which rules fired and why the action was approved.
Kairos writes audit logs to append-only storage (PostgreSQL with temporal tables or S3 with object versioning). Logs are indexed by decision ID, agent ID, and event type for fast retrieval.
Rule Engine Mechanics
Rules are expressed in a domain-specific language (DSL) or JSON schema. Example rule in JSON:
{
"rule_id": "velocity_check",
"condition": {
"and": [
{"field": "amount", "operator": ">", "value": 5000},
{"field": "transactions_last_hour", "operator": ">", "value": 3}
]
},
"action": "flag_for_review",
"weight": 25
}
Rules can reference enriched data. If a node fetches the user's credit score, downstream rules can branch on credit_score < 600.
Kairos compiles rules into an execution plan. It topologically sorts the graph, identifies parallelizable nodes, and generates a query plan for data fetches. This minimizes latency when evaluating complex graphs with dozens of rules.
Handling Mid-Flight Rule Changes
When a rule changes during an active evaluation, Kairos uses one of three strategies:
1. Version pinning: Lock the evaluation to the graph version active when the event arrived.
2. Abort and retry: Cancel the in-progress evaluation and restart with the new ruleset.
3. Best-effort upgrade: Apply the new rule only to nodes not yet executed.
Version pinning is the safest default. It prevents inconsistent decisions when an agent triggers multiple evaluations in quick succession.
Observability and Failure Modes
Kairos exposes metrics for:
- Decision latency (p50, p99)
- Rule hit rate (which rules fire most often)
- Approval/deny/review ratios
- Enrichment API failures
Common failure modes:
- Enrichment timeout: External API (credit bureau, device fingerprinting) takes too long. Kairos can fail open (approve without enrichment) or fail closed (deny by default).
- Graph deadlock: Circular dependencies in the DAG. Kairos detects cycles at graph upload time and rejects invalid configurations.
- State drift: Agent retries a decision after the user's account state changed. Kairos can deduplicate by event ID or allow retries with fresh data.
Deployment Shape
Kairos runs as a stateless service. Decision graphs and rule definitions live in a PostgreSQL database. Audit logs go to S3 or a time-series database.
Typical deployment:
- API tier: Horizontally scaled pods behind a load balancer.
- Graph executor: Worker pool that evaluates decision graphs. Can scale independently from the API tier.
- Enrichment cache: Redis or Memcached to avoid redundant API calls for the same user/session.
For high-volume agents, Kairos can batch evaluations. Instead of one API call per event, the agent sends 100 events in a single request. Kairos evaluates them in parallel and returns an array of verdicts.
Security Boundaries
Kairos enforces two security layers:
1. Agent authentication: API keys or OAuth tokens identify which agent is making the request. Agents can only trigger graphs they have permission to access.
2. Data isolation: Multi-tenant deployments use row-level security in PostgreSQL to ensure one customer's decision graphs and audit logs are invisible to others.
Sensitive data (SSNs, account numbers) can be tokenized before sending to Kairos. The platform stores only the token, and enrichment nodes call a vault service to detokenize when needed.
Technical Verdict
Use Kairos when:
- You need a centralized risk decisioning layer for multiple agents or services.
- Compliance requires detailed audit trails with decision provenance.
- Your risk logic changes frequently and you want to decouple it from agent code.
- You have high-volume agents that need sub-second approval latency.
Avoid Kairos when:
- Your risk logic is simple enough to embed directly in the agent (e.g., a single threshold check).
- You need real-time streaming fraud detection with millisecond latency (Kairos is optimized for 50-500ms request/response).
- You already have a mature rules engine (Drools, FICO Blaze Advisor) and don't want to migrate.
Kairos shines when you have multiple agents (trading bots, payment processors, loan underwriters) that need consistent risk policies without duplicating rule logic in every codebase. The decision graph model makes it easy to visualize and test complex approval workflows before deploying them to production.
Source Links
- Kairos GitHub Repository
- Hacker News Discussion
Show HN: Kairos – Open-source risk and fraud decisioning platform
Hey HN, Ayan here from Finic. We’re launching Kairos, an open source alternative to Sift, Sardine, and other real-time fraud decisioning platforms. Kairos addresses two of the biggest problems facing traditional decisioning tools: a lack of labeled data to train on and dealing with fraudsters that are constantly changing their tactics.
1. Traditional fraud solutions use ML models such as XGBoost to detect fraud, but these models are dependent on quality labeled data which many businesses do not have. We address this by using “System One” decision models in additional to traditional models such as XGBoost and logistic regression. This allows you to incorporate plain language questions such as “Is this a throwaway email” into your decisioning, bypassing the need for large amounts of labeled data. This also allows you to capture aspects of fraud that are more unstructured, which is something that XGBoost models struggle with.
2. Fraud teams are facing off with live players that are constantly changing their behavior to bypass the detection logic they have in place. You can train a detection model or define a ruleset once, but it will become obsolete in a matter of weeks as fraudsters figure out what your detection logic is. This means that you need a team regularly training models and updating rules based on new fraud patterns. Typically this takes a large data science/ML team. Kairos addresses this by introducing an MCP server, so that your agent (Claude Code, Cursor, Codex, etc.) can define a decision workflow, train models on your data, and pick the variant that performs best.
You can self-host Kairos with Docker or use the hosted version at kairos.finic.ai
104 points · 30 comments
Mentions
Kairos: How Open-Source Risk Decisioning Platforms Handle Real-Time Agent Approval Workflows Financial agents need guardrails before executing trades, transfers, or credit decisions. Kairos is an open-source risk and fraud decisioning platform that sits between agent intent and execution. It provides the plumbing for real-time risk scoring, approval gates, and audit trails when agents trigger high-stakes actions. The platform separates risk evaluation from execution. An agent calls Kairos with event data, Kairos runs decision graphs, and the agent receives a verdict: approve, deny, or escalate to human review. This architecture prevents agents from executing risky actions without explicit permission. Decision Graph Architecture Kairos structures risk logic as directed acyclic graphs (DAGs). Each node represents a rule, data enrichment step, or scoring function. Edges define dependencies and branching logic. Key primitives: - Event ingestion: Agents send JSON payloads describing the action (transfer amount, counterparty, account history). - Rule nodes: Boolean conditions (e.g., "amount > $10,000" or "counterparty on sanctions list"). - Enrichment nodes: External API calls to fetch credit scores, device fingerprints, or transaction history. - Scoring nodes: Aggregate risk signals into a numeric score. - Decision nodes: Map scores to outcomes (approve, deny, manual review). Graphs are versioned. When a rule changes mid-flight, Kairos can either pin the in-progress evaluation to the old version or abort and retry with the new ruleset. This prevents race conditions when agents trigger multiple evaluations in parallel. Integration Patterns for Agents Kairos exposes three integration modes: | Mode | Latency | Use Case | Failure Handling | |------|---------|----------|------------------| | Synchronous API | 50-500ms | Real-time approval for low-volume agents | Agent blocks until verdict; timeout returns deny | | Webhook callback | 100ms-5s | High-volume agents that can defer execution | Agent polls status endpoint or waits for webhook POST | | Event stream | Variable | Batch processing or async workflows | Agent consumes from Kafka/Pulsar topic with decision results | Most financial agents use the synchronous API. The agent makes a POST request with event data, Kairos evaluates the decision graph, and returns a JSON verdict: { "decision": "manual_review", "score": 72, "triggered_rules": ["high_velocity", "new_counterparty"], "review_queue": "tier_2_fraud", "decision_id": "dec_9x7k2m" } The agent halts execution and routes the request to a human queue. The decision_id links the agent's action to the audit trail. Audit Trail and Provenance Every decision generates an immutable audit record. Kairos stores: - Input event payload - Graph version and rule set - Intermediate node outputs (enrichment data, partial scores) - Final decision and timestamp - Agent identity and session context This provenance is critical for compliance. If an agent executes a fraudulent transfer, auditors can replay the decision graph with the original inputs to see which rules fired and why the action was approved. Kairos writes audit logs to append-only storage (PostgreSQL with temporal tables or S3 with object versioning). Logs are indexed by decision ID, agent ID, and event type for fast retrieval. Rule Engine Mechanics Rules are expressed in a domain-specific language (DSL) or JSON schema. Example rule in JSON: { "rule_id": "velocity_check", "condition": { "and": [ {"field": "amount", "operator": ">", "value": 5000}, {"field": "transactions_last_hour", "operator": ">", "value": 3} ] }, "action": "flag_for_review", "weight": 25 } Rules can reference enriched data. If a node fetches the user's credit score, downstream rules can branch on credit_score < 600. Kairos compiles rules into an execution plan. It topologically sorts the graph, identifies parallelizable nodes, and generates a query plan for data fetches. This minimizes latency when evaluating complex graphs with dozens of rules. Handling Mid-Flight Rule Changes When a rule changes during an active evaluation, Kairos uses one of three strategies: 1. Version pinning: Lock the evaluation to the graph version active when the event arrived. 2. Abort and retry: Cancel the in-progress evaluation and restart with the new ruleset. 3. Best-effort upgrade: Apply the new rule only to nodes not yet executed. Version pinning is the safest default. It prevents inconsistent decisions when an agent triggers multiple evaluations in quick succession. Observability and Failure Modes Kairos exposes metrics for: - Decision latency (p50, p99) - Rule hit rate (which rules fire most often) - Approval/deny/review ratios - Enrichment API failures Common failure modes: - Enrichment timeout: External API (credit bureau, device fingerprinting) takes too long. Kairos can fail open (approve without enrichment) or fail closed (deny by default). - Graph deadlock: Circular dependencies in the DAG. Kairos detects cycles at graph upload time and rejects invalid configurations. - State drift: Agent retries a decision after the user's account state changed. Kairos can deduplicate by event ID or allow retries with fresh data. Deployment Shape Kairos runs as a stateless service. Decision graphs and rule definitions live in a PostgreSQL database. Audit logs go to S3 or a time-series database. Typical deployment: - API tier: Horizontally scaled pods behind a load balancer. - Graph executor: Worker pool that evaluates decision graphs. Can scale independently from the API tier. - Enrichment cache: Redis or Memcached to avoid redundant API calls for the same user/session. For high-volume agents, Kairos can batch evaluations. Instead of one API call per event, the agent sends 100 events in a single request. Kairos evaluates them in parallel and returns an array of verdicts. Security Boundaries Kairos enforces two security layers: 1. Agent authentication: API keys or OAuth tokens identify which agent is making the request. Agents can only trigger graphs they have permission to access. 2. Data isolation: Multi-tenant deployments use row-level security in PostgreSQL to ensure one customer's decision graphs and audit logs are invisible to others. Sensitive data (SSNs, account numbers) can be tokenized before sending to Kairos. The platform stores only the token, and enrichment nodes call a vault service to detokenize when needed. Technical Verdict Use Kairos when: - You need a centralized risk decisioning layer for multiple agents or services. - Compliance requires detailed audit trails with decision provenance. - Your risk logic changes frequently and you want to decouple it from agent code. - You have high-volume agents that need sub-second approval latency. Avoid Kairos when: - Your risk logic is simple enough to embed directly in the agent (e.g., a single threshold check). - You need real-time streaming fraud detection with millisecond latency (Kairos is optimized for 50-500ms request/response). - You already have a mature rules engine (Drools, FICO Blaze Advisor) and don't want to migrate. Kairos shines when you have multiple agents (trading bots, payment processors, loan underwriters) that need consistent risk policies without duplicating rule logic in every codebase. The decision graph model makes it easy to visualize and test complex approval workflows before deploying them to production. Source Links - Kairos GitHub Repository - Hacker News Discussion
Show HN: Kairos – Open-source risk and fraud decisioning platform (github.com) Discussion | Main Link
What I'd test Wednesday: connect the MCP server to Claude Code, send it 100 labeled shopify_order events, let it propose 3 model variants, then read the ROC-AUC and PR-AUC it reports. finic-ai/kairos
Show HN: Kairos – Open-source risk and fraud decisioning platform finic-ai/kairos (news.ycombinator.com)
Show HN: Kairos – Open-source risk and fraud decisioning platform
Show HN: Kairos – Open-source risk and fraud decisioning platform finic-ai/kairos (news.ycombinator.com)
Kairos is #2 on Hackernews: news.ycombinator.com finic-ai/kairos
Show HN: Kairos – Open-source risk and fraud decisioning platform finic-ai/kairos (news.ycombinator.com)
Show HN: Kairos – Open-source risk and fraud decisioning platform finic-ai/kairos
Show HN: Kairos – Open-source risk and fraud decisioning platform Hey HN, Ayan here from Finic. We’re launching Kairos, an open source alternative to Sift, Sardine, and other real-time fraud decisioning platforms. Kairos addresses two of the biggest problems facing traditional decisioning tools: a lack of labeled data to train on and dealing with fraudsters that are constantly changing their tactics. 1. Traditional fraud solutions use ML models such as XGBoost to detect fraud, but these models are dependent on quality labeled data which many businesses do not have. We address this by using “System One” decision models in additional to traditional models such as XGBoost and logistic regression. This allows you to incorporate plain language questions such as “Is this a throwaway email” into your decisioning, bypassing the need for large amounts of labeled data. This also allows you to capture aspects of fraud that are more unstructured, which is something that XGBoost models struggle with. 2. Fraud teams are facing off with live players that are constantly changing their behavior to bypass the detection logic they have in place. You can train a detection model or define a ruleset once, but it will become obsolete in a matter of weeks as fraudsters figure out what your detection logic is. This means that you need a team regularly training models and updating rules based on new fraud patterns. Typically this takes a large data science/ML team. Kairos addresses this by introducing an MCP server, so that your agent (Claude Code, Cursor, Codex, etc.) can define a decision workflow, train models on your data, and pick the variant that performs best. You can self-host Kairos with Docker or use the hosted version at kairos.finic.ai