# Risk in Production — Latency Budgets, Explainability, and Proving You Prevented Anything *The last mile of a fraud system is operational: score inside the authorization window without becoming the payment path's weakest dependency, explain decisions to customers, auditors, and your own reviewers, and answer the question every budget cycle asks — how much fraud did all this actually prevent, given that prevented fraud is precisely the thing that didn't happen? This closing post is the production discipline that makes the whole stack deployable, defensible, and fundable.* Posts [1](/blog/posts/fraud-01-the-fraud-problem.html)–[7](/blog/posts/fraud-07-humans-in-the-loop.html) built the decision factory; this post runs it — where the series meets [LLMOps](/blog/series/llmops-in-practice/)-style operational discipline and [AI governance](/blog/series/ai-governance-in-practice/) obligations with money on the line. ## Scoring in the money path The fraud call sits synchronously inside authorization, which imposes systems constraints that override modeling preferences. **The latency budget decomposes**: feature fetches (post 3's online store — the dominant cost, which is why features are precomputed and key-value-served, never computed-on-read), model inference (why post 2's GBDTs persist; why deep components precompute embeddings offline), and composition logic — all inside tens of milliseconds at peak. **Degradation is designed, not improvised**: when the feature store is slow or the model times out, the system falls back through declared stages — cached features, a simpler backup model, rules-only scoring (post 2's layer proving its independence), each stage's decision tagged so post-hoc analysis knows which brain decided. Failing *open* (approve on timeout) versus *closed* (decline) is a named policy per segment with costs from post 4 — the same fail-deliberate discipline as bill-06's entitlements, with larger stakes. **And the scoring path is versioned end-to-end** — model version, feature definitions, rule set, threshold schedule, composition logic — every decision stamped with the full configuration that made it, because post-incident forensics and regulatory responses both start from "what exactly decided this?" ## Explainability: three audiences, three products "Explain the decision" means three different deliverables. **Reviewers** (post 7) need contributing signals — top features, fired rules, neighbor cases — optimized for speed-to-judgment; standard feature-attribution tooling serves here, imperfections and all, because the reviewer is a trained skeptic. **Customers and regulators** need *reasons* — adverse-action style statements ("unusual purchase pattern; verification available") that are truthful, non-gameable (detailed enough to be meaningful, vague enough not to hand the adversary your feature list — a tension unique to adversarial domains), and consistent with what the system actually did (the versioned decision record above is the source). **The institution** needs model governance — documented development, validation, bias assessment (declines correlating with protected classes through proxy features is both an ethical failure and a regulatory one; segment-level disparity monitoring belongs on the standing dashboard), and change control: the [governance series](/blog/series/ai-governance-for-engineers/) machinery with a financial-services accent. ## Measuring prevention: the counterfactual problem Fraud prevented is fraud unobserved — so naive dashboards (chargeback rate fell!) can't distinguish your system working from attackers vacationing. The honest measurement stack: **holdout-based estimation** — post 5's exploration slice doubles as the counterfactual: outcomes on would-be-declined traffic estimate what declines prevented, the only direct evidence that exists; **decision-attributed accounting** — every decline, friction-abandonment, and review-decline carries its expected-prevented-amount (score × amount at decision time), reconciled quarterly against holdout-measured reality — an estimated ledger, auditable and improvable, rather than a vibe; **the full cost line** — prevention claims net out FP costs (blocked legitimate revenue, friction abandonment, review spend — posts 4 and 7's numbers), because "we prevented $10M" means little without "and spent $3M in good customers to do it"; and **loss-rate SLOs by segment** — the steady-state health metric (basis points of volume lost to fraud, per segment, against targets), which frames the whole system the way the business actually consumes it: not as a classifier, but as a control system holding losses to a chosen level at a chosen customer-experience cost. That framing is the series' closing thought — the model was never the product; the *controlled trade-off* was. The takeaway: production risk is three disciplines — **the money-path budget** (precomputed features, fast models, staged degradation with named fail-open/closed policies, decisions stamped with full configuration), **explainability as three products** (signals for reviewers, truthful-but-non-gameable reasons for customers and regulators, governance and disparity monitoring for the institution), and **prevention measured against counterfactuals** (holdout slices as ground truth, decision-attributed estimates reconciled to them, FP costs netted, loss-rate SLOs per segment). Run this way, the fraud stack earns the thing adversarial systems need most: the standing credibility to keep being funded, trusted, and improved. ## Key takeaways - The authorization-path budget shapes everything: **precomputed key-value features, fast inference, staged declared degradation** (cached → backup model → rules-only), per-segment fail-open/closed policies, and every decision **stamped with its full deciding configuration**. - Explainability is **three products**: reviewer signals (speed-to-judgment), customer/regulator reasons (truthful, non-gameable, consistent with the record), institutional governance (validation docs, change control, **proxy-bias disparity monitoring**). - Prevention is counterfactual: **holdout/exploration outcomes** are the only direct evidence; run an **estimated-prevention ledger** reconciled against them; always net FP and friction costs into the claim. - The end-state framing: a fraud system is a **control system** — holding loss rates to chosen SLOs at a chosen customer-experience cost — and the model was always just one component of the controller. ## Further reading - [Explainable artificial intelligence — making model decisions accountable](https://en.wikipedia.org/wiki/Explainable_artificial_intelligence) - [False positives and false negatives — the two error currencies every claim must net](https://en.wikipedia.org/wiki/False_positives_and_false_negatives) --- Author: Pratik Dhanave (https://pratikdhanave.com) | Published: 2026-11-08 Canonical: https://pratikdhanave.com/blog/posts/fraud-08-risk-in-production.html Attribution: please link the canonical URL when citing or quoting this post.