Mock Bank Example - Made using Capital One API
Image of person texting a personal agent to request a transaction
Title Slide
Person texting personal agent - result is rejected
Dashboard console of verification software - passing
Dashboard console of verification software - failing

Inspiration

AI agents are starting to handle real money. CRS is building a credit exchange where agents negotiate loans for borrowers and lenders. Banks are connecting assistants to payments. But all of these agents prove who they are the same way: with an API key or login token. That token says nothing about whether a real, authorized person is actually behind the request. If the session gets hijacked, the agent gets tricked by a malicious prompt, or the “customer” was fake all along, the agent keeps spending.

The people most at risk are the ones already trusting assistants with their money: busy professionals who say “pay my rent,” and older adults, who are the top targets for account takeovers and fake-identity fraud. For them, the real question isn’t “is the password right?” It’s “is a real, verified person actually asking for this?”

We’d been working on behavioral biometrics, which recognizes people by how they type and move their mouse. We realized it becomes much more powerful when combined with CRS’s credit bureau identity data and Capital One’s banking APIs. Together, they let a person give an AI agent spending authority that’s tied to them, and that shuts off the moment they’re not there.

What it does

Cadence checks that a real human is behind every payment an AI agent makes.

Say you text your agent: “pay my November rent, $6,000.” Before any money moves, Cadence gathers twelve pieces of evidence across four areas:

Identity (CRS / TransUnion, live): Is this a real person? We verify identity with TruValidate, pull a FICO 9 credit report, and screen for fake identities with Fraud Finder. This is the foundation of the whole system, and it runs live against the CRS sandbox in our demo.
Device (Apple Secure Enclave): Is this the right device? Every check is signed by a key locked inside the Mac’s security chip. Signatures can only be used once and expire after 10 seconds.
Presence (our own on-device model): Is the right person at the keyboard right now? We look at typing rhythm, mouse movement, and session continuity.
Money (Capital One Nessie): Does this payment make sense? We check whether you’ve paid this person before, whether the amount is normal for you, and how fast money is moving, all from the same live ledger the payment runs on.

A rules-based policy engine makes the final decision. Claude then explains that decision step by step in plain language and points out exactly what evidence is missing. Approved payments go through as real Capital One Nessie transfers.

Your agent can spend up to $2,500 on its own, or more once CRS verifies your identity. That permission disappears the instant you’re no longer present. In the demo:

Someone sits down at your unlocked Mac and is frozen out within seconds. A tricked agent tries an unusual payment and is asked for proof only you can give. Anyone with your agent information and bank identity still can't make insecure payments on your behalf. A fake identity (CRS test persona Kayla Brennan) is rejected live by TransUnion’s Fraud Finder.

How we built it

CRS as the identity backbone (CRS Financial Intelligence Challenge). We make live sandbox calls to three CRS products: TruValidate identity verification, the FICO 9 prequalification credit report, and Fraud Finder, using only CRS-provided test personas. CRS does two critical jobs: it confirms the agent’s owner is a real person, and it’s the extra check that unlocks larger payments. Using a credit bureau as the trust anchor for AI agents is something we don’t think anyone has tried, and it fits directly into CRS’s agentic credit exchange.

Capital One Nessie as the payment rails (Best Use of Nessie). We use Nessie from start to finish: creating customers and accounts, making a transfer for every payment the agent sends, and reading the transfer history back. Nessie’s sandbox doesn’t update stored balances, so we calculate balances from its transfer history instead. That means the drop from $18,500 to $12,500 you see on screen is Nessie’s math, not ours. The same history powers our fraud checks, so Nessie is both how money moves and a source of warning signs.

Claude as the explainer (Anthropic track). Claude reads all the evidence, writes a numbered explanation that a customer or bank examiner can follow, and decides which evidence to collect next. We were careful about one risk: a tricked or manipulated AI must never be able to move money. So a fixed set of rules makes the actual decision, and Claude explains it but can’t override it. It does one job well, it’s safe by design, and it’s ready to use today.

Our own behavioral model. We trained a small model (55,000 parameters) to recognize people by how they type. It learned from Aalto University’s public dataset of 136 million keystrokes from 168,000 people, reaching about a 5.6% error rate on people it had never seen. We tested it against the CMU benchmark and used Balabit data for mouse movement. It then adapts to you in a few seconds from 90 seconds of typing. For privacy, raw keystrokes stay in memory for at most 12 seconds, and we only ever save rough key categories and timing, never what you typed.

Hardware security. A small Swift tool creates a key inside the Mac’s Secure Enclave chip. Every presence score is signed with it, and we check each signature, make sure it hasn’t been used before, and confirm it’s fresh.

Challenges we ran into

Mouse tracking was unreliable. Our mouse model scored real users poorly, so we limited it to confirming someone is there at all and let typing do the heavy lifting.
Nessie doesn’t update balances. We worked around it by calculating balances from transfer history, which actually made the demo more trustworthy since the numbers come straight from Nessie.
The CRS sandbox locks accounts after failed logins. We made our client stop after one failure and handle it gracefully rather than retrying and getting locked out.
Claude once contradicted the decision. It called an approved payment a violation. Fixing this meant spelling out the policy rules in its instructions, and it confirmed our design choice: the AI explains, it never decides.
Security is hard to show on video. We rebuilt the demo so every check, including TransUnion rejecting the fake identity live, is visible on screen.

Accomplishments that we're proud of

Three CRS products working live in one flow, as the core of the product rather than an add-on Using Nessie end to end, with one payment traceable across the chat receipt, the decision screen, and the bank balance (same transfer ID, same $18,500 → $12,500)
An AI agent that can’t be tricked into approving payments, because it doesn’t make the decision
A behavioral model built from public data that catches someone taking over the keyboard in 5 to 7.5 seconds, never wrongly locked out a real user in our tests, and scores bots near zero (0.02)
Everything in the demo runs live against real APIs. Nothing is mocked up.

What we learned

Identity isn’t one thing. Who you are (CRS data), what you have (your device’s security chip), and whether you’re present right now (behavior) each fail differently. Combining them catches attacks that any one alone would miss.
Each check covers the others’ blind spots. Fake-identity fraudsters behave consistently, so behavior tracking can’t catch them, but Fraud Finder can. Session hijacking is the reverse. You need both, which is why CRS plus live presence is the whole product.
Use AI for what it’s good at. Let it explain and plan; keep it away from the actual approval. That separation is what makes an AI agent safe to trust with money.
Sandbox limitations can improve your design. Calculating balances from Nessie’s transfer history made our demo verifiable instead of just for show.

What's next for Cadence

A developer toolkit so any AI agent can request limited, revocable, human-backed spending permission in a few lines of code, built to plug into CRS’s agentic credit exchange
Real data everywhere: replace placeholder network and location signals with real session data, and swap our simple payment rules for a trained risk model using more Nessie history
Adapting over time as a person’s typing habits change, plus support for multiple devices
A pilot with a real lender, where large transactions are approved through a live credit bureau check instead of a password reset