◆ Supervised Router
Reads each market-abuse alert, reconstructs the order-and-execution sequence, pulls the trader mandate and the prevailing market, and dispositions clear noise with a cited rationale. Scores against the spoofing, layering, wash-trade and front-running typologies, escalates anything above a conduct-risk threshold to the surveillance oversight agent, and retains a full reconstruction trace.
Memory
Working Per-alert scratchpad: the order sequence, hypotheses, disposition lean.
Episodic Prior alerts on the same trader/desk/instrument.
Semantic Market-abuse typologies (MAR/MAD) and the firm's surveillance scenarios.
Procedural Disposition playbooks refined from oversight-agent overrides.
Store Vector + time-series market context store
Orchestration
router-fanout MCPA2A
Harness · Managed Agents … session event-log per alert; context editing clears stale market-data dumps on long reconstructions.
Tools
{ } Surveillance platform API { } Order + execution records API { } Market data feed API ⌕ Trader mandate / restricted lists Retrieval ⇄ Escalation to surveillance oversight agent A2A
Evals & guardrails
- Gold-set precision/recall vs. the labelled disposition set; agent-as-judge sampling.
- Hard guardrail: cannot auto-close above a conduct-risk threshold … forced escalation to the oversight agent.
- Full OpenTelemetry trace of every reconstruction retained for audit.
- Monthly typology-drift detection against newly confirmed conduct cases.
Offline reflection
Nightly consolidation: replays oversight-agent overrides as Reflexion-style lessons, updating the disposition playbook (procedural memory).
Frontier edge
- ▲On-device edge inference: a distilled scorer runs on the surveillance feed itself, dispositioning clear noise in milliseconds before it ever queues.
- ▲World-model order-book simulation: replays the cancelled volume against a counterfactual book to test whether it could ever have executed … intent indicia, not just pattern match.
- ▲Eval-gated continual learning (SEAL-style): the disposition policy self-edits from each oversight-agent override and ships only after clearing the gold-set, so new manipulation typologies are absorbed without a full retrain.
A sample run
Trigger Spoofing alert: large sell orders placed and cancelled around a small buy fill.
- 1Reconstruct the full order lifecycle with timestamps against the order book.
- 2Check whether cancelled volume ever rested at executable prices.
- 3Pull the trader's mandate and recent alert history on the instrument.
- 4Score against the spoofing typology; draft rationale.
Output Escalates to the surveillance investigation desk with a pre-built packet … intent indicia and order-book impact quantified; clear-noise alerts auto-close with notes.
In numbers
9,800
Alerts dispositioned / day
91%
False-positive auto-clear rate
44s
Avg. time per alert
Handoffs
Hands to → Conduct Investigation Agent