Finance is not one decision either. A transaction monitor asks whether a payment is suspicious, a procurement system asks whether an order needs approval, a credit workflow asks how a business should be classified, and a trading loop asks what to do in the next block. The common rule is that the model answers a bounded question and deterministic code keeps the money, the limits and the audit trail.
Monitoring starts with a gate, not a verdict
The JEV Fraud Risk POC is a useful architecture comparison. It shares one 10,000-transaction dataset across two designs: all-Qwen, and a System One/Laya gate that stops low-risk transactions at confidence 0.70. The dataset has 1,000 customers, 9,000 safe and 1,000 fraudulent transactions, seed 42, multiple fraud patterns and deliberate anomalies in the safe rows. The actualFraud and fraudPattern fields are benchmark ground truth and must never be sent to either model.
That last constraint is the one teams get wrong. A fraud benchmark is only meaningful if the model sees the same information a production system would see, which usually means no label, no investigation outcome and no post-hoc pattern tag. The repository checks in the generated fraud-dataset.json so runs stay reproducible, but its README lists no license and the digest includes no result tables, so which architecture wins on cost, accuracy or latency is not stated there.
Procurement fraud shows the split
The SAP S/4HANA procurement fraud project is more explicit about who decides. It sends five Noul questions, one Score from 1 to 5 and one Choice per order, and ABAP, not the model, always assigns the final class. The thresholds are below 0.20 to release, up to 0.60 to route to approval, and above 0.60 to block, documented as an uncalibrated hypothesis rather than a validated policy.
The measured cost on the first real call was US$0.0000913 for a seven-question evaluation, about US$0.09 per thousand orders. It runs in shadow mode only: evaluations are logged and no order is ever blocked, while blocked vendors are a hard ABAP rule that bypasses Jev entirely. Privacy is enforced by an automated test: no supplier names, user IDs or order numbers leave the system, only days, ratios, counts and flags. The project has no license file, so the code is all rights reserved by default, and its test-system views lack authorization checks.
This is the right deployment order for fail-closed finance: shadow first, thresholds second, blocking last. A model that only routes to a human is still useful, and it produces the data needed to calibrate the next step.
Credit and vendor decisions need closed answer sets
Jev NAICS classifies business descriptions into one of 1,012 NAICS 2022 industries, or holds them, for insurance applications where a wrong neighbor code misprices risk. No LLM writes anything: Postgres search, spelling correction, a modern-terms lexicon, a tree walk and every gate are code, and Jev only picks from a closed list.
The hybrid path used 56 Jev calls for 16 blind descriptions where the tree walk alone used 84. It measured 15 right and 1 held on the 16-case blind held-out set, with zero wrong codes across blind, dev and messy-dev sets. Without a TypeSafe key it replays answers recorded on jev-1.13.0 and refuses unrecorded descriptions instead of guessing, returning a service error or HTTP 409.
The caveats are unusually candid: the eval sets are small and synthetic and should be read as evidence the gates fail closed, not as a production accuracy estimate. In the external check the dataset's own labels were wrong for 18 of 60 descriptions. The project is MIT-licensed and pinned to jev-1.13.0. That is a better claim than a high accuracy number, because it describes behavior at the edge of coverage.
The evidence layer is a separate decision
The same-number citation swaps study is not a fraud detector, but it is the best available test of a related finance judgment: whether a cited number actually supports a calculation. It uses Jev as a source-support verifier for GPT-4.1-mini calculation traces on financial reports, holding operands and arithmetic fixed while moving citations between same-number cells.
A signed-number-at-pointer baseline explains most recovery over exact quotation checks. Explicit column labels improve selected wrong-role decisions while lowering support for some equivalent evidence, and a follow-up on 36 new source pages, labeled by a single non-author reviewer, exposes the same tradeoff. The result is a controlled finding, not a deployed financial assistant.
That distinction matters because finance teams often want one model to read the document, do the arithmetic and judge the answer. Those are three decisions. The arithmetic should be code, the extraction should be typed, and the support judgment should be evaluated separately.
Market probabilities are not forecasts of value
Model vs Market puts three decision models, OpenAI Decisions, TypeSafe Jev and Cloudflare Clef, on market questions. The models read recent news and never see the odds, and the site compares their probabilities with live Polymarket and Kalshi prices and replays how each model changed its mind article by article. There is no published evidence of scoring accuracy, market coverage or update cadence beyond the live site, so it is a demonstration of the contract rather than a track record.
Jev Trader is the lower-latency version. Jev answers buy or sell every roughly 300 ms block on Kuru's MON-USDC market, asked about the move over 100 blocks, about 30 seconds. With MODEL=jev and a TypeSafe key it uses the model; the default mock is a momentum heuristic, and no PRIVATE_KEY makes it a dry run. Dry-run measurements were book read p50 18 ms and whole loop p50 100 ms. With a private key it places real post-only orders, which is trading risk, not a model evaluation.
The per-tick decision glossary entry and the trading and markets roundup cover the rest of that design space.
Keep execution deterministic
jev-clerk is the cleanest small example of the split. It opens a supplier invoice in Preview, types it into Frappe Books, saves, submits and files the PDF, while a read-only accounting database acts as referee. Jev answers two multiple-choice questions per step at about 0.35 seconds and $0.0002 per decision, and the System 2 model never touches the screen.
In the recorded run, 30 real invoices over 90 iterations used 1,141 Jev calls for $0.24 and 978 seconds of System 2 thinking. Correct bookings on USD invoices went from 0/9 under playbook v0 to 9/9 by v6 and v8, while block 4 regressed to 0/9 after a rewrite. Two block-8 misses were a parser bug, not Jev. Every playbook rewrite is validated by code so the action list stays closed.
That is the finance pattern in miniature. The model chooses from a set the code already understands, the code performs the action, and the audit record shows the state, the questions and the version. The policy trees and approval gates and decision models as judges pieces cover the surrounding controls, and the use-case map lists financial crime and insurance claims as example domains rather than validated products.
The precision and recall tradeoff belongs in the threshold discussion, not in the model prompt. Decide what a false block costs, what a missed fraud costs, and set the number accordingly. Then measure it on your own data, because every result above is either a project self-report or a controlled study, not a production guarantee.
