Sift · anatomy · The Agentic Bank

L1 triage that clears profile-consistent noise, escalates genuine typologies, and defaults to escalate under doubt.

First stage of the financial-crime pipeline. Closes false positives; escalations flow to Bloodhound for investigation.

Methodology

1 Read the alert; identify the customer and the flagged transactions.
2 Pull the profile and the transactions and ask the central question: is the activity consistent with who this customer is and their expected activity?
3 Pull prior alerts; repeat alerting on the same behaviour, or a pattern across alerts, raises suspicion.
4 Weigh recognised AML typologies against the facts: structuring, funnel / pass-through, new-account velocity, profile deviation, and the benign explanations.
5 Disposition close-no-action, close-with-note, or escalate. Default to escalate under doubt; never close unexplained activity to clear a queue.

Sandboxed tools

In-process MCP tools only. Built-in tools disabled, settingSources [], permissionMode bypassPermissions. The only ground truth is the tools.

get_alert read

The alert: scenario, description, flagged transaction ids, customer.

get_customer read

The customer's KYC profile, risk rating, and expected activity.

get_transactions read

The flagged transactions and surrounding activity.

get_prior_alerts read

The customer's alert history (relationship context).

record_triage commit

Commits the triage disposition. Called exactly once.

Outcome contract

A triage disposition with a risk score, short reason codes, and a narrative grounded in the profile and the transactions.

▸ the validated schema (Triage)

type Triage = {
  disposition: "close-no-action" | "close-with-note" | "escalate"
  riskScore: number               // 0..1
  reasonCodes: string[]           // e.g. ["structuring","sub-threshold-cash"]
  narrative: string               // grounded in the profile + transactions
  recommendedNextStep: string
}

Grounding

synthetic Synthetic bank fixtures. Customers, transactions, alerts, and relationship history. Synthetic, because real customer data would be proprietary.

real Recognised AML typologies. Structuring, funnel / pass-through, layering, new-account velocity, profile deviation.

Governance seams

The three trust boundaries a runtime governance layer clamps onto. Shown here ungoverned, so you can see exactly what would be inspected, redacted, or blocked.

Model plane

context in

The Sift methodology and risk posture, plus each turn's accumulated tool results.

governor → Constrain or log the full context window sent to the model.

Tool plane

every read

Each get_alert / get_customer / get_transactions / get_prior_alerts call's full I/O.

governor → See which customer records were read; enforce least-privilege on the data pulled.

Data plane

the commit

The recorded triage disposition written to the case journal.

governor → Audit close decisions; sample-review closes for quality.

Sift files nothing itself. Its disposition is the gate that decides whether an investigation begins, so closing a truly suspicious alert is the costly error the posture is tuned against.

Evals & guardrails

9 / 9 golden Graded on triage posture (acceptable dispositions plus must-not guards).

Structuring across branches. Escalates sub-threshold cash kept just under the $10k CTR line.
Cash-intensive business. Clears profile-consistent activity with a recorded rationale instead of reflexively escalating.
Insufficient information. Escalates rather than clearing when the activity cannot be reconciled.

Orchestration

Router front-line triage

⇢Escalations flow to Bloodhound
⇢First stage of Sift → Bloodhound → Scribe → Oversight