The stack / 04 · Learn
Product 04 · Learning loop

Every outcome returns as labeled learning.

Settlement, clearing, and dispute outcomes attach to the decision that produced them. The result is a corpus of outcome-labeled agent decisions that only the authorization path can build, and it is what lets the models learn fraud at the speed fraud evolves.

Why this exists

Because fraud models starve without labels.

Every fraud detector decays. What decides how fast is the feedback: most vendors see transactions or outcomes, rarely both, and almost never with the agent's stated reasoning attached. Labels arrive from annotators, late and expensive, while agent fraud adapts at software speed.

Sitting in the authorization path means reality grades our work: every decision we screen comes back settled, disputed, or deflected, and attaches itself to the full decision record as a label. We built the loop because that position compounds. It is the reason the system gets harder to beat every month, and the reason we built everything else.

How it learns

From outcome to detector, continuously.

Outcome labelingevery decision closed by its resultEach authorization ends as settled, disputed, or deflected. That outcome becomes the label on the full decision record: intent, gates, scores, and behavior.
Behavioral baselinesseven signal classes per agentAgents build behavioral fingerprints; drift against a baseline is a leading indicator of compromise, detected before transaction attributes look wrong.
EDQS retrainingdual evidence · attestation vs behaviorAttested reasoning is scored against observed behavior; divergence is itself a signal. The v2.1 framework and its validation track are published.
Adversarial validationpublic benchmark · MITThe defense is tested in the open: an AgentDojo evaluation with the harness, frozen configuration, and raw run logs published for anyone to re-run.
Fraud analytics with live threat level and a possible agent-compromise alert
Fraud analytics · demo environment
What's different

The data position no detector can buy.

Labels from outcomes, not annotatorsSettlement, clearing, and dispute results label decisions automatically. No annotation backlog, no analyst bias: the economy itself grades every decision the models learn from.
Dual evidence beats gamed tracesAn agent can learn to write better-scoring reasoning. It cannot rewrite its observed behavior. Attestation is scored against telemetry, and divergence between them is itself the detection signal.
Per-tenant baselines raise attacker costDimensions are published; weights, thresholds, and your baselines are not. A mimicry attack must replicate seven signal classes simultaneously, per tenant, without seeing the target.
Published and re-runnableThe framework, the telemetry paper, and the adversarial benchmark are public. Skeptics can re-run the numbers with their own keys, which is what makes the numbers worth anything.

The moat is the labeled corpus.

Read the EDQS v2.1 framework, the behavioral telemetry paper, and the public benchmark behind the loop.