Deep Dive: AI + Rules Engines

The most common question about AI and rule engines is which one will replace the other. The answer, from every production AI system we could examine, is: neither. Models estimate; rules decide.

A model is the part that learns from data. It can say "this payment looks 87% likely to be fraud" (a judgment no one had to write down). A rule is the part your business controls: "block anything scored above 80, unless it's a long-standing customer; above $5,000, send it to review." One supplies the judgment, the other supplies the policy, and real systems always ship both, because each is strong exactly where the other is weak:

• Models find patterns nobody wrote down, but their answers are probabilities, retraining takes days or weeks, and explaining any single answer is hard.
• Rules are exact, auditable, and change in minutes, but they only know what someone thought to write.

What follows are the six ways production systems combine them, each with named, cited examples, and what each pattern asks of the rules engine. The short version: AI doesn't shrink the rules workload; it multiplies it, because every model score becomes one more input rules must act on, instantly, on every event.

1. The model scores; the rules decide🔗

The most widespread pattern: the model's output lands next to the business data, and human-written rules make the actual decision.

• Stripe Radar scores every payment 0–99 for fraud risk; merchants then write rules that combine that score with ordinary business facts (amount, payment method, country) to block, allow, or send to review. Stripe's default controls treat 65+ as elevated risk and 75+ as high risk, and merchants retune those thresholds from a dashboard, instantly (Stripe docs).
• Sift returns a real-time fraud score and lets fraud managers act on it with criteria like orders over $500 from Canada with a fraud score above 80, a rules layer designed to add under 50 ms even at the 99th percentile, because it runs inside the transaction (Sift engineering).
• Braze predicts each customer's churn risk (0–100) with a model rebuilt about every two weeks, but marketers act on it through segment rules they can change today (Braze docs).

In Winnow: a model score is just another numeric column. A risk score of 75 or higher, on an amount over $5,000, from one of two flagged countries is one rule evaluation, answered in microseconds alongside every other condition, and the threshold is a text edit, not a deployment.

2. The rules guard the model🔗

Here the model proposes and the rules have veto power, encoding the law, the brand, or the board's risk appetite as hard bounds the model cannot cross.

• Upstart, whose lending models fully automated 91% of loans in 2024, applies each bank partner's own underwriting policy (minimum credit scores, loan-amount limits, maximum debt-to-income) as hard knockout criteria before an application ever reaches the models (Upstart 10-K filing).
• Airbnb's Smart Pricing models suggest a nightly price for each of 4 million+ listings, but a suggestion is adopted only if it falls inside the host's own minimum/maximum. The host's simple rule, not the model, has the final say on every published price (KDD 2018 paper).
• Airline pricing works the same way at scale: PROS, whose platform drives 400 million+ prices a day for carriers, applies rule-based adjustments and guardrails around its demand-forecasting models' outputs (PROS).

In Winnow: floors, ceilings, exclusions, and jurisdiction rules are ordinary conditions evaluated against every model output, changed the moment policy changes, with nothing retrained and an exact record of what rule decided what.

3. The rules prune; the model ranks🔗

Model inference is expensive; rule evaluation is cheap. So high-volume systems put a rules gate in front of the model and let it discard almost everything.

• Snap's ad system makes "trillions of predictions every day," but the first stage of its funnel is pure rules: targeting, budget, privacy, and policy checks decide which of millions of ads are even eligible before any model scores a candidate (Snap engineering).
• Meta's ad delivery works the same way: only ads whose advertiser-chosen targeting includes the person enter the auction; the machine-learning ranking runs on what survives (Meta).
• The AI-search version of the pattern: Glean's enterprise AI assistant filters every document its retrieval step finds through the querying user's live permissions, so the model can only see (and quote) what that user is allowed to see (Glean). And Pinecone found that evaluating attribute filters inside vector search makes filtered queries faster than unfiltered ones (51.6 ms vs 79.2 ms on a ~1.2M-record index) (Pinecone).

In Winnow: this gate is exactly Winnow's native job, matching one event against millions of eligibility rules in microseconds (the ad-targeting percolation problem), so the expensive model only ever sees the shortlist.

4. The model detects; the rules route🔗

Detection systems produce scored suspicions; rules turn suspicion into a manageable amount of human work: thresholds, suppression, escalation, routing.

• HSBC replaced blunt transaction-monitoring with Google Cloud's AML AI across 1.2 billion+ monthly transactions: the model scores every customer for money-laundering risk, and a threshold policy (set to match investigator capacity) decides who gets investigated. Result: 2–4× more suspicious activity found with 60% fewer alerts (Google Cloud).
• Palo Alto Networks' own security operations run on Cortex XSIAM: machine learning groups roughly a trillion events a month into incidents, and an automation layer of playbook rules closes out the noise, leaving about eight incidents a day for humans (Palo Alto Networks).
• In hospitals, UC San Diego Health's deep-learning sepsis model scores every emergency-department patient hourly, but a nurse is alerted only when the score crosses a set threshold and eligibility rules pass (patient still in the ED, treatment not already given). The combination cut sepsis deaths by 17% (relative) in a two-hospital study (npj Digital Medicine).

In Winnow: "alert when the score crosses the threshold, for a covered service, and not during a maintenance window" is a standing rule book evaluated per event: the real-time alerting shape, with thresholds an operator can move while the stream keeps flowing.

5. The rules keep AI agents on a leash🔗

The newest and fastest-growing pattern. An AI agent doesn't just answer; it acts: calls tools, moves money, edits records. Every single action needs a policy decision, and one user request can fan out into dozens of actions.

• Amazon's Bedrock AgentCore Gateway checks every tool call an agent makes against explicit permit/forbid policies (who, what action, which resource, in what context) before the call reaches any real system, adding under a millisecond per check, with a policy change deployable by API call, no redeploy (AWS).
• Visa's Intelligent Commerce lets AI agents find products and initiate payments, but only inside pre-defined spend controls and approval rules, on a network whose AI already scores every transaction in about a millisecond and blocks some $40 billion in fraud a year (Visa).
• Microsoft 365 Copilot consults Purview data-protection rules on every prompt: content carrying certain sensitivity labels is excluded from what the AI may read or repeat, and an admin's policy edit reaches the whole tenant within hours; no model change involved (Microsoft).

In Winnow: an agent's tool call is one more event checked against a policy book (the access-control shape), at machine speed. When agents act thousands of times a second, a policy check that costs milliseconds becomes the bottleneck; one that costs microseconds disappears.

6. The rules run the AI factory🔗

Rules don't just act on model outputs; they keep the machinery that produces models honest.

• Google's TFX platform validates the several petabytes of data a day flowing into hundreds of production models against a declared schema of constraints: types, allowed values, expected distributions. One training-versus-serving mismatch it caught was worth a 2% install-rate improvement on the Google Play homepage (MLSys paper).
• Uber's D3 watches the feature data behind production models (pricing included) with per-column monitors (null rates, percentiles, distributions) and cut the time to detect data problems by more than 20× (Uber engineering).
• OpenAI rolled out ChatGPT features behind Statsig feature gates, rules deciding per user which model variant runs, scaling to hundreds of experiments across hundreds of millions of users, with an instant flag-flip as the rollback plan (OpenAI has since acquired Statsig) (Statsig).

In Winnow: data validation at ingest is a built-in (schema constraints); drift monitors are threshold rules over statistics; rollout gates are the feature-flag shape.

Why the rules half has to be fast🔗

Notice what AI did to the rules workload in every story above. It didn't remove it; it multiplied it:

• Every score is one more decision. Each scored payment, post, patient, or alert now needs a policy evaluation on top of the model call.
• Agents fan out. One user request becomes dozens of tool calls, each needing a permission check on the hot path.
• The funnel gate sees everything. The pruning stage runs against millions of candidates per request, before the model does any work at all.
• Policy moves faster than models. Braze retrains every two weeks; Salesforce Einstein every ten days; HSBC's models retrain on a governed cadence. But when fraud spikes or a regulator calls, the rules change in minutes. The rules layer is where a business actually steers its AI.

That is the workload Winnow is built for: model scores are ordinary columns, policy is plain editable text, every check costs about three microseconds, and rules change live without pausing a single decision.

Each use-case page in this section now carries a short "with AI in the loop" note showing how these patterns land in that domain.