Frozen
a change needs a release
By the time the rule ships, the pattern moved.
Agentic AI · Fraud
Agentic Fraud Ops
Transaction alerts scored, branched and routed by rules you draw yourself. Amount, channel, direction, country and customer risk are all fields you can condition on.
Same day
Change a rule
No release
No engineering ticket
Dry run
Measure before you commit
One record
Shared with AML
Why this matters
Fraud rules age faster than anyone reviews them.
A threshold set for last year’s volume is a noise generator this year. The problem is not that rules are wrong, it is that changing one means a ticket, a release and a week.
Blind
no way to test first
Nobody wants to tune a live rule, so nobody tunes it.
Split
fraud and AML disagree
Two systems reach two verdicts about the same customer on the same day.
How it works
Scroll to advance
Draw it, simulate it, switch it on
-
Step 01
A transaction trips a scenario
The alert carries score, amount, direction, channel, country and the customer’s risk level.
-
Step 02
The agent reads the pattern
It weighs the transaction against the customer’s own baseline, not an industry average.
-
Step 03
Your rule decides
Branch on amount, channel or country. Set a status, convert to case, or fire a webhook to your own system.
-
Step 04
You measure before you commit
Leave it in dry run and read what it would have done across a week of real traffic.
sanctionscanner / tm / alert
- Score78
- Amount24,500
- ChannelInstant
sanctionscanner / agent / decision
- DecisionEscalate
- Confidence81
- Deviation+320%
sanctionscanner / rule / builder
- If amount> 10,000
- And channelInstant
- ThenConvert to case
sanctionscanner / agent / dry-run
- Simulated4,182
- Would close2,740
- Would escalate61
Trip
Score
Branch
Prove
The rule builder
Draw it, simulate it, publish it
The same canvas, conditioned on transaction fields instead. Leave it in dry run and read what it would have done.
What the builder gives you
A rule you can change on a Tuesday
Visual rule canvas
Drag a trigger, a condition and an action onto the canvas. No scripting, no deploy.
43 condition fields
Confidence score, match status, risk level, entity type, amount, channel, article count and more.
11 operators
Equals, greater than, between, in, is true and the rest, so a rule reads like a sentence.
13 actions
Close, set status, set risk, assign, tag, note, notify, convert to case, webhook, toggle monitoring.
Branch and switch
One canvas can hold several outcomes: close the clear ones, route the rest, escalate the few.
Dry run first
Run the rule against live traffic without touching a single case, then read what it would have done.
What it leaves behind
Every run is a record
An agent that acts without a trail is a finding waiting to happen. Each execution writes what it saw, what it decided and what it changed.
Applied
The rule matched and the action was carried out
Logged
Dry run
Simulated only, so you can measure before you switch it on
Logged
Skipped
Matched, but a guard stopped the action
Logged
Failed
The action could not complete, with the reason attached
Logged
Agentic AI
The rest of the agent suite
FAQ
Before you switch it on
Does the agent act on its own?
Only where you let it. Every action is a node you place yourself, and you can leave a rule in dry run indefinitely.
What if the AI is unsure?
Confidence is a number you can branch on. Most teams auto-close above a high threshold, route the middle band to an operator and escalate the rest.
Can we see what it did?
Every execution writes a log entry: which rule, which node, what it saw, what it changed, and whether it applied, simulated, skipped or failed.
How do we roll it back?
Set the rule to draft and it stops immediately. The log stays, so an auditor can still read what happened while it was on.
Run it against a day of your own traffic
Bring a sample file. We will draw one rule, simulate it and show you the alert volume it removes.
Minutes
To first rule
No code
To change one
Dry run
Before it touches a case