Risk AI Agent is Incode's adaptive, machine-learning-based fraud decisioning system. Instead of applying fixed rules and weights to individual checks, it evaluates all available signals from a verification session in context. After weighing how each signal affects the others, it produces a single, more accurate pass/fail decision. It reduces the need for regular threshold tuning or custom rules.
Risk AI Agent replaces the legacy TotalScore model.
Risk AI Agent must be enabled for your organization. Contact your Incode representative to enable it. After it's enabled, add the Risk AI Agent module to your Flow or Workflow.
{/* TODO: Confirm how Risk AI Agent is implemented in Flows and Workflows: as a module, a setting like Deepsight, or both. If both, how do they work together? */}
Session Decisioning
Risk AI Agent evaluates signals from across the verification session, including document validation, biometric checks, cross-field consistency, session timing, device risk, and more. It produces a fraud probability score between 0 and 1. Sessions scoring above the threshold fail; sessions scoring below pass.
View a text description of the diagram
The diagram shows Risk AI Agent's decision architecture. Input signals flow from right to left into a central Autopilot AI Agent. This agent undergoes continuous retraining and outputs a context-aware session decision.
The agent draws on two primary input categories:
- OCR & data cross-check: Optical character recognition and data validation signals
- Biometric matching: Comparison of biometric data across the session
These branch into more granular signals, including:
- Liveness: Sub-signals for Client ID, Face features, and Behavior and device signals
- Document features: Document-level signals feeding into the same decision pipeline
Additional signal inputs are indicated but not individually labeled.
Decisioning Logic
Risk AI Agent does not operate in isolation. A session fails if any of the following are true, regardless of the Risk AI Agent score:
- Trust Graph fails
- Deepsight scores below 0.5
- Government Validation scores below 0.81
If Risk AI Agent does not run, the session falls back to TotalScore. When Risk AI Agent is active, the total_score field in the score API response returns a pass/fail value instead of a numeric score.
Signal Inputs
The model ingests confidence scores, not pass/fail statuses, from most checks, including:
- ID validation
- Tamper and alteration detection
- Fake document detection
- Paper and screen liveness
- Face recognition
- OCR
It also incorporates session timing signals, device risk indicators, the client ID, and the document type.
Because Risk AI Agent uses underlying confidence scores rather than check statuses, severity settings on most checks have little effect on its output. The exceptions are liveness (physical, digital, and evasion) and face recognition. For these, Risk AI Agent uses both status and confidence thresholds, so severity settings on those checks can influence outcomes.
**Required dependency: ID Validation (processID) must be included in the Flow or Workflow for Risk AI Agent to function. Liveness and face recognition are not required but improve accuracy.
Explainability
Risk AI Agent is a gradient-boosting decision tree model and cannot produce a rule-based explanation of its output. Instead:
- For sessions that fail, it surfaces the top 3 contributing signals that drove the decision: for example, document alteration and face recognition.
- For sessions that pass, it surfaces signals that support legitimacy.
A narrative risk assessment summary is also available in the responseText field of the API response.
Rules Engine Compatibility
Rules that override the final session decision (for example, forcing a fail when a specific check fails) continue to work alongside Risk AI Agent. Rules that send sessions to Manual Review also continue to work.
Rules that modify module weights or scores do not affect Risk AI Agent, because the model uses the original confidence scores as inputs.
Supported Regions
Risk AI Agent is available for Mexico, the United States, and Colombia. Sessions from other countries fall back to TotalScore.