Let's integrate AI Agents in Event-Sourced Systems — Divakar Kumar, FlyersSoft

The speaker advocates for integrating AI agents into existing business workflows, extending their utility beyond chatbots to deliver tangible value in core business operations. The focus is on real-time fraud detection, a domain where a common problem arises: legitimate transactions are occasionally declined without clear justification, falling into a “gray zone” that conventional rule-based engines and machine learning models struggle to resolve.

Limitations of Existing Systems

Rule-based engines, while initially effective, become challenging to maintain due to the dynamic nature of fraud. Constant updates are required to keep pace with evolving fraud patterns. Similarly, ML models, which provide a risk score based on historical transaction data, still encounter ambiguous cases. Both systems excel at handling transactions that clearly fall below (approve) or above (block) defined thresholds. However, a significant portion of transactions remains in an uncertain “gray zone,” where neither system can definitively classify them as fraudulent or legitimate. The proposed solution does not replace these existing Tier 1 systems but rather complements them with a Tier 2 agentic AI approach specifically designed to address these ambiguous scenarios.

Bounded Contexts and Data Flow

The underlying architecture comprises several distinct bounded contexts, adhering to microservice principles and communicating asynchronously via a message broker:

• Transaction Context: Manages transaction-specific details such as merchants and amounts. It deliberately lacks information about customers or devices.
• Accounts Context: Stores customer-related information, including KYC compliance and overall account details.
• Device Context: Holds device and browser fingerprints, operating system data, and other device-specific information crucial for fraud detection.
• Payment Context: Handles payment-related processes, including chargebacks.

Event Sourcing and Semantic Layer

The system implements an event-sourcing methodology, where all business facts are recorded as immutable events (e.g., transaction created, payment approved). Cosmos DB serves as the event store. Change Data Capture (CDC) or change feeds are utilized to propagate these events to various read models optimized for query operations (e.g., timelines, customer information, fraud indicators). To provide comprehensive context for the AI agents, a “semantic layer” or “materialized view” is constructed. This involves aggregating data from all bounded contexts through CDC or message brokers, processing it via worker processes, and storing it in this unified view. This semantic layer denormalizes critical information such as transaction counts, average amounts, recent transactions, device trust scores, location histories, KYC statuses, account age, and recent payment activities.

Agentic Architecture Details

AI agents are integrated into an existing orchestration layer, which operates similarly to a saga orchestration pattern. This layer now incorporates both the traditional Tier 1 (rule-based/ML) and the new Tier 2 (agentic AI processing) components.

• Agent Components: Each agent consists of a Language Model (which can be a Large Language Model or a Smaller Language Model), Tools, and Memory. For real-time fraud detection, short-term in-memory storage is prioritized to meet strict Service Level Agreements (SLAs), typically sub-500 milliseconds.
• Reasoning and Loops: Agents employ reasoning capabilities to break down complex tasks. They can execute iterative loops, using tools to interact with external APIs or internal application methods, until a specific goal is achieved.
• Avoiding Infinite Loops: A critical consideration is the implementation of metrics or conditions to terminate these loops, preventing agents from indefinite execution and ensuring adherence to performance requirements.
• Fan-out Pattern and Specialized Agents: When an event enters the Tier 2 layer, it is fanned out to multiple specialized agents:
  • Risk Analyzer Agent: Leverages tools to query fraud histories (from the semantic layer), device trust scores, and specific business rules.
  • Behavior Analyzer Agent: Utilizes tools to analyze transaction patterns.
  • Verdict Agent: A third agent (preferred over simple metric-based if conditions to minimize false positives) consolidates the responses from the Risk Analyzer and Behavior Analyzer agents to render a final decision. This decision is then emitted as an event back to the message broker, perpetuating the saga flow to other relevant contexts, such as payment approval.

Integration and Context Provisioning

The orchestration layer consumes data from the projection layers via the agents’ specialized tools:

• Transaction Context: Provides denormalized data like transaction counts, average amounts, and recent transaction details.
• Device Context: Supplies device trust scores, location histories, and IP addresses.
• Account Context: Offers account statuses, KYC status, and account age.
• Payment Context: Delivers recent payment histories. This rich, contextual data, accessible through dedicated tools, empowers the AI agents to make informed judgments in the ambiguous “gray zone” cases that traditional systems cannot resolve. The speaker concludes by highlighting that event-sourced systems naturally provide the historical state and context required by agents, making the layering of agents onto existing event streams the most efficient method to infuse sophisticated judgment into production systems.

• Tags:
• AI Agents
• Agentic AI
• LLMs
• Microservices
• Machine Learning
• Semantic Layer
• Fraud Detection
• Change Data Capture
• Event Sourcing
• Bounded Contexts
• Saga Orchestration
• Real-Time Systems
• Cosmos DB