Product Screen Components Preview

Enterprise OS

PlantoOS›Agents›fraud-detector

running

Agent Runtime

Run #4,817 · Started 14:32:01 UTC

Latency

287ms

Tokens

1,284

Cost

$0.0038

Steps

6 / 6

Agent Workflow Timeline

Trigger Received0ms

Context Loaded42ms

Policy Evaluated58ms

Tool: query_db124ms

Tool: classify_intent203ms

Response Composed287ms

Step Execution Log

14:32:01.042INFOAgent invoked via webhook trigger /api/v1/agents/fraud-detector

14:32:01.058INFOPolicy stack evaluated — 6 rules passed, 0 denied

14:32:01.124DEBUGTool query_db executed in 66ms — 23 rows returned

14:32:01.203DEBUGTool classify_intent completed — confidence 0.94

14:32:01.245WARNToken budget 82% consumed — switching to compact mode

14:32:01.287INFOResponse generation started — streaming enabled

Tool Invocation History

Tool	Latency	Tokens	Status
query_db	66ms	340	success
classify_intent	79ms	128	success
fetch_user_profile	34ms	96	success
validate_schema	12ms	54	success

Agent Details

Agentfraud-detector

Versionv2.4.1

Modelgpt-4o-mini

Ownerrisk-team

Regionus-east-1

Permissions

query_db

classify_intent

fetch_user_profile

send_alert

Trace

Trace IDtr-8f2a1b4c-e937-4d0a-b512-c7e9f3a1d604

Span IDsp-0a3c7e91

Parent Run#4,816

Object ID	Type	Scope	TTL	Last Updated	Provenance
mem-0a7f3c	Fact	Global	∞	2 min ago	crystallization
mem-1b8e4d	Observation	Agent	24h	5 min ago	runtime-capture
mem-2c9f5e	Decision	Project	7d	12 min ago	agent-output
mem-3d0a6f	Fact	Team	∞	1 hr ago	crystallization
mem-4e1b7g	Intuition	Global	30d	2 hr ago	distillation
mem-5f2c8h	Observation	Agent	12h	3 hr ago	runtime-capture
mem-6g3d9i	Fact	Org	∞	5 hr ago	manual-entry
mem-7h4e0j	Decision	Project	90d	8 hr ago	agent-output

Memory Metadata

Object IDmem-0a7f3c

TypeFact

ScopeGlobal

TTL∞

Versionv3

Confidence0.96

CreatedMar 7, 14:30 UTC

Linked Runs

#4,817·fraud-detector

14:32 UTC

#4,812·risk-scorer

14:28 UTC

#4,799·data-enricher

14:15 UTC

Retention Policy

Policyenterprise-standard

RetentionIndefinite

EncryptionAES-256-GCM

AuditEnabled

Auto-ArchiveAfter 90d inactivity

Recent Access

fraud-detector read · 2 min ago

risk-scorer read · 18 min ago

data-enricher write · 1 hr ago

PlantoOS›Governance›Policy Stack

34 rules active

Policy Stack

Evaluation order: top → bottom · Higher layers override lower

Evaluation Order

Org Policy

Organization-wide defaults

12 rules

Team Policy

risk-engineering

8 rules

Project Policy

fraud-detection-v2

5 rules

Agent Policy

fraud-detector

3 rules

Tool Policy

query_db, classify_intent

4 rules

Action Policy

send_alert, block_transaction

2 rules

Evaluation Direction →

Active Rules

Showing all layers

Policy	Rule	Scope	Effect	Version	Updated
Org Policy	max-tokens-per-run	All agents	Limit	v3.1	Feb 28
Org Policy	require-audit-trail	All agents	Enforce	v3.1	Feb 28
Team Policy	pci-data-masking	risk-engineering	Enforce	v2.0	Mar 3
Project Policy	max-db-queries	fraud-detection-v2	Limit (10)	v1.4	Mar 5
Agent Policy	deny-external-api	fraud-detector	Deny	v1.0	Mar 6
Agent Policy	allow-internal-tools	fraud-detector	Allow	v1.1	Mar 6
Tool Policy	query_db-row-limit	query_db	Limit (100)	v2.2	Mar 4
Tool Policy	classify-confidence-min	classify_intent	Enforce (>0.8)	v1.0	Mar 1
Action Policy	alert-requires-approval	send_alert	Gate	v1.0	Mar 7
Action Policy	block-txn-dual-confirm	block_transaction	Gate	v1.0	Mar 7

PlantoOS›Lineage›Run #4,817

287ms total

Execution Lineage

Run #4,817 · fraud-detector · 8 events

Event Timeline

Trigger14:32:01.000

Webhook /api/v1/agents/fraud-detector

POST · 204 bytes · api-gateway-east

Agent Step14:32:01.042

fraud-detector initialized context

Context: 3 memory objects loaded · Model: gpt-4o-mini

Tool Call14:32:01.124

query_db → transactions_recent

23 rows · 66ms · Token cost: 340

Policy Check14:32:01.130

pci-data-masking evaluated

Rule: mask SSN + card fields · Result: PASS

Tool Call14:32:01.203

classify_intent → fraud_probability

Confidence: 0.94 · Latency: 79ms · Token cost: 128

Policy Check14:32:01.210

classify-confidence-min evaluated

Threshold: >0.8 · Actual: 0.94 · Result: PASS

System Action14:32:01.250

Memory crystallization triggered

New Fact created: mem-0a7f3c · Scope: Global · TTL: ∞

Outcome14:32:01.287

Alert dispatched to risk-ops channel

Severity: HIGH · Transaction ID: txn-9f8e2d · Flagged: true

Selected Event

Tool Call

query_db → transactions_recent

Event IDevt-3c7a1b

Timestamp14:32:01.124

Duration66ms

Token Cost340

Input Size128 bytes

Output Size2.3 KB

Run Metadata

Run ID#4,817

Tracetr-8f2a1b4c

Agentfraud-detector v2.4.1

Triggerwebhook

Duration287ms

Events8

Policies Checked2 PASS, 0 DENY

Data Sources

transactions_recent (DB)

user_profiles (Cache)

fraud_rules (Config)

Medhara

Medhara›Memory›Explorer

892 objects

Search memories by content, type, or provenance…

Observationobs-7a3f

User login frequency decreased by 34% after policy update

Scope: ProjectTTL: 24hv1Confidence: 0.883 min ago

Factfact-2b8e

Fraud detection accuracy improves 12% when combined with behavioral signals

Scope: GlobalTTL: ∞v4Confidence: 0.9615 min ago

Decisiondec-4c1d

Route high-risk transactions through dual-agent verification pipeline

Scope: TeamTTL: 30dv2Confidence: 0.911 hr ago

Intuitionint-9e5g

Correlation detected between API latency spikes and false-positive rate increases

Scope: GlobalTTL: 90dv1Confidence: 0.722 hr ago

Observationobs-6f2a

Agent retry rate spikes during peak trading hours (14:00–16:00 UTC)

Scope: AgentTTL: 12hv1Confidence: 0.854 hr ago

Factfact-8d4c

PCI compliance requires masking of all card fields in agent memory

Scope: OrgTTL: ∞v7Confidence: 0.996 hr ago

Provenance Chain

Raw observation captured

14:15 UTC · data-enricher

Pattern matched across 23 runs

14:22 UTC · pattern-detector

Crystallized to Fact

14:28 UTC · medhara-core

Validated by risk-scorer

14:30 UTC · risk-scorer

Source Events

Run #4,812 — pattern match

Run #4,799 — data correlation

Run #4,783 — initial observation

Linked Workflows

Fraud Detection Pipeline142 runs

Risk Assessment Flow89 runs

Compliance Audit34 runs

Medhara›Crystallization›Pipeline

Memory Crystallization Pipeline

Transforming raw signals into durable knowledge

Raw Observations

247objects

Structured Facts

89objects

Distilled Intuitions

23objects

Raw Observations

User login frequency decreased 34% post-policy update

obs-7a3f·0.88

monitor-agent · 14:15 UTC

API response time spiked 2.3× during batch processing window

obs-8b4g·0.82

perf-monitor · 14:12 UTC

Retry rate in fraud-detector correlates with peak trading hours

obs-9c5h·0.85

data-enricher · 14:08 UTC

Structured Facts

Fraud detection accuracy improves 12% with behavioral signals

fact-2b8e·0.96·v4·3 sources

Significancehigh

Policy: PASS

PCI compliance mandates masking of all card fields in memory

fact-3c9f·0.99·v7·5 sources

Significancecritical

Policy: PASS

Distilled Intuitions

Correlation between API latency spikes and false-positive rate

int-9e5g·0.72·2 linked facts

MaturityEmerging

Significance: Medium

Agent autonomy correlates inversely with error rate in regulated domains

int-0f6h·0.68·1 linked facts

MaturityForming

Significance: Medium

Medhara›Capabilities›fraud-detector

4 Approved 3 Denied

Agent Permissions

fraud-detector v2.4.1 · Capability-based access control

Allowed Tools

query_db

read-only

classify_intent

ml-inference

fetch_user_profile

read-only

validate_schema

utility

Denied Tools

send_alert

Requires dual-confirm gate

delete_record

Not in agent capability set

external_api_call

Blocked for regulated agents

Policy Evaluation Trace

Org Policy

allow-internal-toolsAllow

deny-delete-operationsDeny

require-audit-trailEnforce

Team Policy

pci-data-maskingEnforce

allow-db-readAllow

Project Policy

allow-ml-inferenceAllow

max-concurrent-callsLimit

Agent Policy

deny-external-apiDeny

allow-profile-readAllow

Final Result

Approved· 4 tools granted

Medhara›Lineage›Graph Explorer

7 nodes · 7 edges

Lineage DAG

Command

Agent

Tool

System

Outcome

Command

POST /detect-fraud

Agent

fraud-detector

Tool

query_db

Tool

classify_intent

System

memory-store

System

policy-engine

Outcome

Alert Dispatched

Selected Node

Agent

fraud-detector

Node Metadata

Data Sourcewebhook · api-gateway

Policy Versionv3.1

Timestamp14:32:01.042 UTC

Linked Memorymem-0a7f3c, mem-1b8e4d

Execution Time245ms

Token Usage1,284

Modelgpt-4o-mini

StatusCompleted

Connected Nodes

← cmd-1 (Command)

→ tool-1 (query_db)

→ tool-2 (classify_intent)

← sys-1 (memory-store)

Coding Assistant

Coding Assistant›Editor›fraud-detection.ts

Context Active

Explorer

src

services

fraud-detection.ts

risk-scoring.ts

transaction-validator.ts

models

utils

config

tests

package.json

tsconfig.json

fraud-detection.ts×

risk-scoring.ts

1import { TransactionEvent } from '../models/transaction';

2import { RiskScore, FraudSignal } from '../models/risk';

3import { PolicyEngine } from '../core/policy-engine';

5export class FraudDetectionService {

6 private policyEngine: PolicyEngine;

7 private confidenceThreshold = 0.85;

9 async detectFraud(event: TransactionEvent): Promise<FraudSignal> {

10 const riskScore = await this.calculateRiskScore(event);

11 const behavioralSignals = await this.analyzeBehavior(event);

13 // Combine risk factors with behavioral analysis

14 const combinedScore = this.fuseSignals(riskScore, behavioralSignals);

16 if (combinedScore.confidence > this.confidenceThreshold) {

17 await this.policyEngine.evaluate('fraud-alert', combinedScore);

18 return { flagged: true, score: combinedScore, action: 'review' };

19 }

21 return { flagged: false, score: combinedScore, action: 'pass' };

22 }

23}

Context Memory

Related Files

risk-scoring.ts

transaction-validator.ts

policy-engine.ts

Architecture Notes

Fraud detection uses a two-stage pipeline

Risk scoring feeds into behavioral analysis

Policy engine gates all alert dispatches

Past Decisions

Switched from threshold-only to combined scoring (v2.3)

Added behavioral signals in sprint 47

Confidence threshold raised from 0.75 to 0.85

PR Feedback

"Consider adding rate limiting" — @sarah

"Good separation of concerns" — @alex

"Add integration test for edge cases" — @mike

Coding Assistant›Workflow›Task #2,847

Step 3 of 4

Task: Implement fraud detection rule

Add device fingerprint validation to the fraud detection pipeline

Auto-discovered: 3 existing rules·Estimated: 4 steps·Started 45s ago

Agent Plan

1. Scan repository for existing fraud rulesComplete12s

Found 3 rule files in /src/rules/ — velocity-check.ts, amount-threshold.ts, geo-anomaly.ts

velocity-check.tsamount-threshold.tsgeo-anomaly.ts

2. Retrieve rule patterns from memoryComplete3s

Loaded 5 pattern templates from context memory — rule structure, validation schema, test fixtures

rule-template.tsvalidation.schema.ts

3. Generate validation logic for new ruleIn Progress

Generating device-fingerprint validation rule based on retrieved patterns and existing rule conventions

device-fingerprint.ts (generating)

4. Create unit and integration testsPending

Will generate test cases covering: valid transactions, flagged transactions, edge cases, concurrent processing

device-fingerprint.test.ts

Context Sources

Rule patterns (Memory)Project structure (Indexed)Test conventions (Memory)PR #1,392 feedback

Progress

75%

Coding Assistant›Trace›Suggestion #5,291

All tests pass

Suggestion Traceability

Full lineage from prompt to commit

Prompt

Reasoning

Files Changed

Tests Generated

Commit Suggestion

Prompt

Add a device fingerprint validation rule to detect fraud based on device change patterns. Should follow existing rule conventions and include tests.

Reasoning

Analyzed 3 existing rules for conventions. Device fingerprint rule requires: hash comparison, geo-correlation, velocity check on device changes. Using the same RuleBase interface and policy integration pattern.

Pattern: existing rules use RuleBase abstract class

Validation: multi-signal approach (hash + geo + velocity)

Testing: mirror structure of velocity-check.test.ts

Policy: integrate with existing fraud-alert policy gate

Files Changed

src/rules/device-fingerprint.ts

Created+87

src/services/fraud-detection.ts

Modified+4 −1

src/config/rule-registry.ts

Modified+2

Tests Generated

should flag transaction with new device fingerprint

should allow known device with matching geo

should detect rapid device switching pattern

should handle missing fingerprint gracefully

should respect confidence threshold from config

Commit Suggestion

feat(fraud): add device fingerprint validation rule

Implements device fingerprint tracking and validation for the fraud detection pipeline. Uses multi-signal approach combining hash comparison, geo-correlation, and device change velocity.

feature/device-fingerprint-rule3 files+93−1

Product Screen Components Preview

Enterprise OS

Agent Runtime

Agent Workflow Timeline

Step Execution Log

Tool Invocation History

Agent Details

Permissions

Trace

Tags

Memory Metadata

Linked Runs

Retention Policy

Recent Access

Policy Stack

Evaluation Order

Active Rules

Execution Lineage

Event Timeline

Selected Event

Run Metadata

Data Sources

Medhara

Provenance Chain

Source Events

Linked Workflows

Memory Crystallization Pipeline

Raw Observations

Structured Facts

Distilled Intuitions

Agent Permissions

Allowed Tools

Denied Tools

Policy Evaluation Trace

Lineage DAG

Selected Node

Node Metadata

Connected Nodes

Coding Assistant

Context Memory

Task: Implement fraud detection rule

Agent Plan

Context Sources

Suggestion Traceability

Prompt

Reasoning

Files Changed

Tests Generated

Commit Suggestion