Fraud & risk
Score events against current state on the write path, with reads that always reflect the writes that just landed.
The problem
Why this is hard today
Fraud and risk scoring live or die on a single property: the state you score against must include the event you are scoring. A velocity check that reads a rolling count which does not yet include the current transaction is not a check — it is a delay before the fraud clears.
Most stacks introduce exactly that delay: the write goes to one system, the feature store updates asynchronously, and the scorer reads a stale snapshot. The gap is small in milliseconds and enormous in dollars.
What risk needs is read-your-writes freshness on per-entity state, and counts that are exact — because a threshold compared against an approximate count is a threshold you cannot defend in an audit.
Architecture
How NYXDB does it
Per-entity state lives in keyed and attribute tables that are updated on the write path; a scoring read sees the write that just landed, and the counts behind it are exact.
- 01
Write + update
A write updates per-entity rolling state on the write path, committed atomically under MVCC.
- 02
Read-your-writes
The next read reflects that write — no async feature-store lag window.
- 03
Score
The scorer reads current state and exact counts to decide.
- 04
Audit
Historical and AS OF reads reconstruct exactly what state a decision saw.
Real SQL
In practice
CREATE TABLE account_state ( account_id String NOT NULL, tx_count_1h UInt64, PRIMARY KEY (account_id)) SETTINGS mode='keyed';SELECT account_id, tx_count_1h, tx_count_1h > 25 AS flaggedFROM account_stateWHERE account_id = 'acct-1';SELECT count() FROM account_state WHERE tx_count_1h > 25;Every statement follows the engine’s own test SQL shapes. See the SQL reference for full syntax.
Capabilities
What you get
Read-your-writes
No stale window between the write and the scoring read.
Exact counts
Thresholds compared against exact counts, not estimates.
Per-entity state
Keyed and attribute tables hold rolling state per account.
Auditable history
AS OF reconstructs the exact state a decision saw.
Streaming scores
STREAM SELECT drives real-time scoring off the write path.
Low-latency reads
Current-state reads are point reads, not scans.
Proof
Measured on the vetted benchmark lane
no stale scoring window
core semantics
engine
exact keyed count() behind thresholds
O(1), flat 1k–16k keys
vetted table
View benchmark71.6nspoint consult on warm postings
sharded point lookup ~1µs
vetted table
View benchmarkMeasured on Apple M4 Max (dev), macOS — server-class validation pending. Release build, median of 5, commit-pinned (d4a3885b, 2026-07-07). Ingest figures are engine-side. See the full benchmark suite.
Score against state that includes the event
Run a node and wire a read-your-writes velocity check.