One row per employee for the selected lookback (15m, 1h, or 24h). Each employee has three counters in the DB; pick one window to avoid seeing the same person three times.
Windows: 15, 60, 1440 minutes. Ingest: +1 txn (and +suspicious if flagged) per event. Rolling: COUNT/SUM from orders where ingested_at ∈ [now−window, now).
Suspicious if: final_score ≥ 45, any rule triggered, or tip-exceeds flags.