Velocity checks and fraud-ring detection, off the hot path

Rolling velocity and relationship features

PAA consumes the transactions.completed Kafka topic keyed by sender_id and processes the full stream in the background. It maintains rolling per-sender velocity windows (1h and 24h) and per-receiver pagerank approximations that surface accounts sitting at the center of suspicious flows.

These signals catch fraud rings and shared-device clusters before any single transaction crosses the decision threshold — the kind of coordinated behavior that per-transaction rules miss because each individual payment looks ordinary.

Feeding the hot path without coupling to it

PAA writes its computed feature deltas back to Redis under predictable keys, so RDA’s next prediction reads the updated behavioral context automatically. The two agents never call each other directly — they communicate only through the feature cache and the event bus.

That decoupling is deliberate: if PAA lags, restarts, or fails, authorization is unaffected. RDA simply falls back to default values for any missing feature keys, so a pattern-analysis outage never blocks a payment.

• Consumes transactions.completed keyed by sender_id; processes the full stream asynchronously.
• Maintains rolling per-sender velocity windows (1h, 24h) and per-receiver pagerank approximations.
• Writes feature deltas back to Redis under predictable keys so RDA’s next prediction sees them.
• Surfaces emerging rings and shared-device clusters before any single transaction crosses threshold.
• Failure does not block authorization — RDA falls back to default features for any missing keys.