Real-time fraud classifier

What this template is

Pattern: real-time scoring of card / account / transfer transactions. The output is bounded to a 3-state verdict + confidence band + short rationale string. Reviewer-gate on low confidence routes uncertain decisions to manual review without blocking the happy path. Fallback to deterministic 'decline' when the LLM fails — fraud-detection conservatism: a false-positive is recoverable, a missed flag is not. Spec hash + model identity per L12 entry give PSD2 Art. 95 + DORA Art. 17/18 evidence requirements a structured answer.

import { RuntimeAISpec } from '@promethean/runtime-ai';

export const fraudClassifierSpec: RuntimeAISpec = {
  specId: 'fraud-classifier-v1',
  displayName: 'Real-time fraud classifier',
  description:
    'Per-transaction fraud verdict for card + transfer flows.',
  category: 'classifier',
  schemaVersion: 'promethean-runtime-ai-spec-1.0',
  canonicalForm: 'v1',

  inputSchema: {
    fields: [
      { name: 'transactionId', type: 'string', required: true,
        redaction: 'hash-only' },
      { name: 'amountMinor', type: 'number', required: true,
        min: 0, max: 100_000_00 },
      { name: 'currency', type: 'enum', required: true,
        enumValues: ['EUR', 'GBP', 'USD'] },
      { name: 'merchantCategoryCode', type: 'string', required: true,
        maxLength: 4 },
      { name: 'cardHash', type: 'string', required: true,
        redaction: 'hash-only' },
      { name: 'ipReputation', type: 'enum', required: false,
        enumValues: ['known-good', 'unknown', 'known-bad'] },
    ],
  },

  outputSchema: {
    fields: [
      { name: 'verdict', type: 'enum', required: true,
        enumValues: ['approve', 'review', 'decline'] },
      { name: 'confidence', type: 'number', required: true,
        min: 0, max: 1 },
      { name: 'rationale', type: 'string', required: true,
        maxLength: 280 },
      { name: 'matchedRules', type: 'string-list', required: false,
        maxItems: 8, maxLength: 64 },
    ],
  },

  promptTemplate: {
    system:
      'You are a payment-fraud risk-scoring assistant. ' +
      'Output one of: approve, review, decline. ' +
      'Be conservative on uncertainty — prefer "review" to a wrong "approve". ' +
      'Rationale must be ≤280 chars and cite specific risk signals.',
    user:
      'Transaction {{transactionId}}: {{amountMinor}} {{currency}} ' +
      'at merchant category {{merchantCategoryCode}}. ' +
      'IP reputation: {{ipReputation}}.',
  },

  modelIdentity: {
    provider: 'anthropic',
    model: 'claude-sonnet-4-5',
    version: '20250929',
  },

  reviewerGate: 'on-low-confidence',
  lowConfidenceThreshold: 0.7,
  maxLatencyMs: 800,
  fallbackBehavior: 'deterministic-default',
  deterministicDefault: {
    verdict: 'decline',
    confidence: 0,
    rationale: 'Fallback: LLM unreachable, conservative decline.',
  },
};

Regulations addressed

This template's configuration choices map to specific regulatory obligations. The substrate doesn't certify compliance — but the spec hash + reviewer-verdict + modelIdentity per L12 entry give you the evidence layer for these citations:

• ·PSD2 Art. 95 — operational + security risk management
• ·DORA Art. 17/18 — ICT incident classification
• ·AMLD 6 Art. 8 — risk management

See citations index for official source URLs →