Ten Features. One Shared Language. Why Pretext Uses Primitives, Not Patterns Alone

James Waddell | Founder & Managing Partner, Aegis Studios | 2026-04-20

---

Pattern Matching Catches Yesterday's Scam. Feature Matching Catches Tomorrow's.

Every text message has a shape, and scammers know how to bend that shape. They might swap "urgent action required" for "quick question," change the sender domain, or alter their excuses. Most scam detectors focus on recognizing the outdated patterns. By the time these models are updated, the scammers have already filed off the serial numbers.

Pretext takes a groundbreaking approach. Instead of chasing surface patterns, we focus on matching the *underlying behavioral and linguistic signals*—the ten feature primitives that remain consistent across generations of scam tactics. The essence of urgency compresses similarly in 2019 and 2026. The refusal to verify the victim's identity remains the same, regardless of whether the scammer poses as a bank, a romantic interest, or an investment advisor. The platforms may evolve (gift card → crypto → wire to foreign exchange), but the primitive *unusual payment rail* stays constant.

This is not accidental. This is governance by design.

---

What Are Primitives? Four Examples in the Wild

A primitive is the *reason* a text is suspicious, not the *text itself*. Here are four of the ten primitives:

F-URG: Urgency Compression

The legitimate world operates in natural time. Banks usually ask you to verify a transaction within 24 hours, accountants schedule meetings days in advance, and mortgage lenders provide ample time for document reviews.

In contrast, scammers compress time with phrases like "Act within 2 hours" or "If you don't wire by midnight, I can't help you." This synthetic urgency aims to short-circuit your questioning instincts.

Real example from Pretext's pattern library: *"I have maybe 1-2 hours. After that, the deal goes to someone else. Are you interested or not?"* This urgency appears in crypto investment scams, forex schemes, and investment platform onboarding. The words evolve, yet the primitive remains.

F-VER: Refusal to Verify

Legitimate service providers encourage you to verify their identities: call the number on the back of your card or hang up and contact the bank's official line. These steps protect you, while they slow down the scammer.

Scammers, however, discourage verification. They might say, *"Don't call the bank, they don't understand new account rules."* or *"Don’t ask your spouse, this has to stay between us."* The refusal is the primitive; the excuses change daily.

F-RAIL: Unusual Payment Rail

Legitimate transactions utilize regulated rails like bank transfers or checks, accompanied by a paper trail. Conversely, scammers prompt you to use primitive rails that settle instantly, such as gift cards or cryptocurrency wallets, which leave no evidence and are hard to reverse:

If someone asks you to send value through an unusual payment rail—*particularly* to verify your identity or unlock a larger transfer—that's the primitive firing.

F-ISO: Isolation Prompt

Real institutions involve other people. Accountants CC spouses, banks seek approvals, and HR personnel coordinate with managers. Scammers ensure isolation:

*"This is confidential. Don’t tell your family."* or *"Your company doesn't need to know. Just do it."* This calculated isolation prevents the person from getting help, enabling the scam to proceed unhindered.

---

Why Primitives Beat Patterns for Governance

This distinction between surface patterns and feature primitives transcends technicalities. It reflects a critical governance choice.

Explainability

When Pretext flags a message as a probable scam, it identifies *which features activated*, not merely a confidence score. You’ll see: *"Urgency compression detected (F-URG). Refusal to verify detected (F-VER). Unusual payment rail detected (F-RAIL)."* This insight explains *why* the system considers something suspicious. This approach aligns with what the Building Constitution calls "feature-level attribution" — the system is accountable for its decisions based on specific triggering behaviors.

Robustness

While scammers can change their phrasings, they cannot alter the primitives themselves. A new scam kit deploying urgency + authority claim + unusual payment rail will trigger the same feature primitives, regardless of the exact language used. Primitives withstand the test of time because they are rooted in human behavior rather than merely language patterns.

Accountability

Publishing hit rates per primitive encourages public scrutiny. Pretext benchmarks demonstrate 82.2% overall recall on 400 held-out messages, alongside detailed per-feature performance. For example, Pig Butchering scams (the investment romance hybrid) achieved an 88.6% recall on F-VER and F-RAIL (refusal to verify + unusual payment rail). This transparency allows researchers to ask specific questions about how Pretext performs against certain primitives, providing factual insights over marketing terms.

Patterns are often black boxes; primitives are auditable.

---

The Honest Catch: One Primitive We Had to Downweight

Governance involves genuineness. Here’s a catch.

F-GRAM—stylistic fingerprints exhibiting non-native English grammar—initially showed promise. Yet in our v1 benchmark on held-out 400 messages, F-GRAM had only a 55% recall on English-native scam content. Fluent scammers with polished grammar could evade detection, while genuine non-native English speakers might be flagged as a scam.

Recognizing this, we downweighted F-GRAM in the v2 pipeline. This illustrates accountability in governance: you build, measure against real data, identify flaws, rectify them, and communicate your findings. Grammar represents a weaker scam signal; behavioral signals like refusal to verify and unusual payment rail are much stronger. Consequently, v2 emphasizes these robust indicators.

---

From Consumer Tool to Enterprise: The Same Architecture

This feature-primitive architecture is scalable. Protecting a single consumer against a $5,000 investment scam raises the question: *"Is this text a scam?"* But for a board overseeing an AI-enabled decision system with $5 million in budget authority, the question becomes: *"Is this system trustworthy?"*

The architecture remains consistent. Feature-level attribution. Primitive-level transparency. Auditability.

BoardSight employs the same principles when scoring board readiness for AI adoption — it outlines which governance domains (Explainability, Bias Mitigation, Incident Response, Workforce Impact) are most susceptible, rather than providing a single score. GovLayer utilizes this method when auditing governance policies — breaking down every failed policy against distinct regulatory primitives (data minimization, consent proof, audit trail) rather than simply offering a compliance checkbox.

Cognitive's Building Constitution fosters this ethos: every AI system must be explainable and auditable down to its feature-level decisions. This principle functions effectively across both scam detection systems and enterprise AI systems managing significant capital investments.

---

Key Takeaways for CTOs

• Implementing Primitives: Encourage the adoption of feature primitives in AI governance systems to enhance explainability and robustness against evolving scams.

• Transparency and Accountability: Advocate for transparency in algorithmic decisions within AI systems to facilitate auditing and enhance public trust.

• Real-Time Adaptability: Emphasize the need for systems that recognize stable primitives rather than just adapting to fluctuating patterns.

---

Ship the Primitives. Let Others Build On Them.

The ten-feature taxonomy Pretext employs is open-licensed, available for creative use on the Pretext app's Features page.

Should you discover a scam pattern not detected by Pretext, consider: *Which primitive should it fire?* If a new one is warranted, we want to hear about it. If it’s an existing primitive missed by Pretext, that’s a tuning problem we can address.

Governance is not merely a feature of your product. It embodies a shared language for your community.

---

Keywords: Pretext, cognitive corp, AI governance, scam detection, governance, methodology, explainability, feature-primitives, patterns, Aegis Studios, Building Constitution, shared language, transparency, accountability, adaptive systems, real-time response, CTO insights.