> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amrood.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Risk Monitoring

> Real-time risk scoring, anomaly detection, and graph analysis

# Risk Monitoring

Amrood monitors every transaction for suspicious patterns using both real-time rule-based scoring and periodic graph analysis.

## Real-Time Risk Scoring

Every transaction is scored against these signals:

| Signal                  | Score | Trigger                                      |
| ----------------------- | ----- | -------------------------------------------- |
| Velocity spike          | +20   | More than 10 transactions in 5 minutes       |
| New counterparty        | +10   | First payment to this recipient              |
| Near-limit amount       | +10   | Amount exceeds 90% of per-tx limit           |
| Circular payment        | +40   | Recipient recently paid this agent           |
| Micro-transaction burst | +30   | More than 20 transactions in 5 minutes       |
| Near-threshold          | +15   | Amount between 90-100% of approval threshold |

## Score Thresholds

| Score Range | Action                                         |
| ----------- | ---------------------------------------------- |
| 0–29        | **Pass** — transaction proceeds                |
| 30–59       | **Flag** — transaction proceeds, alert created |
| 60–79       | **Hold** — requires manual review              |
| 80+         | **Block** — transaction denied                 |

## Risk Alerts

Flagged transactions generate alerts in the admin review queue:

```json theme={null}
{
  "id": "rsk_abc123",
  "agent_id": "agt_xxx",
  "alert_type": "circular_payment",
  "risk_score": 80,
  "details": {
    "circular_payment": true,
    "velocity_spike": true,
    "velocity_count": 15
  },
  "status": "open"
}
```

Alert statuses: `open` → `reviewed` / `dismissed` / `escalated`

## Graph Analysis

Every 6 hours, a background worker analyzes the full transaction graph for patterns that individual-transaction scoring can't catch:

### Cycle Detection

Finds circular payment paths (A → B → C → A) using depth-first search. Catches coordinated laundering across multiple agents.

### Hub-and-Spoke

Flags agents sending to more than 10 unique recipients in 24 hours — potential cash-out behavior.

### Layering Detection

Identifies agents that receive funds and immediately forward them (within 5 minutes) to another agent. Catches money layering when this happens repeatedly.

### Micro-Flood

Detects agents with high transaction volume (50+) but low average amount (under ₹100) — a common technique to stay below monitoring thresholds.

## Containment Actions

When suspicious activity is detected:

1. **Flag** — alert created, admin notified
2. **Quarantine** — agent can receive but cannot send (prevents further dispersal)
3. **Freeze** — all transactions blocked, owner notified
4. **Owner freeze** — all agents under an owner frozen simultaneously

See [Kill Switches](/governance/kill-switches) for containment operations.