In plain words: One row per employee — their long-term habits. Risk rises slowly when flagged orders happen; Trust is just 100 minus Risk.
Risk formula (each order): new_risk = old_risk × 0.9 + final_score × 0.1 — where final_score is that order’s detection score (0 if no rule fired).
Trust formula: trust = 100 − risk (capped 0–100). Example: Risk 40 → Trust 60.
Note: After “Aggregate now” with rolling snapshots, Risk/Trust may be copied from the latest daily employee snapshot (average of triggered scores) instead of the EMA.