Alert to SAR
Detection raises thousands of alerts a week; a fraction become cases; a fraction of those become SAR filings. Seven agents run this line front-to-back — with Conductor planning each flagged case and routing the specialists.
Orchestration
Plans a flagged case end to end, routes each stage to the specialist agents, and replans from every result to an auditable final disposition.
- hands to Sift via run_triage
- hands to Bloodhound via run_investigation
- hands to Scribe via run_filing
Detect
Scenario rules score every transaction; alerts queue for triage.
Every payment and onboarding name is screened against the OFAC SDN list.
Triage & disposition
Front-line disposition of monitoring alerts at scale — close with a note, or escalate with reason codes.
Clears or blocks sanctions name-match hits against the OFAC SDN list in real time.
Pull refreshed customer due diligence into the case file when triage escalates. Open slot — no agent staffs this step yet.
Inter-institution information requests on escalated cases. Open slot — no agent staffs this step yet.
Investigate
Builds the investigation packet on escalated cases and recommends SAR / no-SAR — delegating the sanctions screen to Cerberus over A2A.
- hands to Cerberus via screen_subject
File & review
Drafts the regulatory SAR narrative from the packet, validates completeness, and files with FinCEN.
Self-improves the SAR narrative against a completeness rubric — never adding a fact the packet does not contain.
Escalated cases and filing decisions land here — the human gate Aarvion's sar-filing-gate policy enforces mid-run.
The regulatory rail the SAR actually goes out on.
Tune
Proposes detection-threshold changes and adopts them only when an eval gate certifies precision improves.
The walkthrough
- 1
Monitoring scenarios and screening engines raise thousands of alerts a week. This is where the volume problem starts.
- 2
Sift disposes transaction-monitoring alerts at scale — close with a note, or escalate with reason codes.
Replay the real runsc-sift - 3
Cerberus clears or blocks sanctions name-hits in real time against the OFAC SDN list.
Replay the real runsc-cerberus - 4
Escalations open a case. Bloodhound builds the investigation packet — and hands the subject back to Cerberus over A2A for a fresh sanctions screen.
Replay the real runsc-bloodhound - 5
On a flagged case the fleet works as one: Conductor plans the case, routes each stage to the specialist, and replans from every result.
Replay the real runsc-conductor - 6
Filing is the seam that matters. With Aarvion attached, the SAR dispatch is blocked mid-run and the case lands with the BSA officer instead.
Replay the real runsc-conductor-aarvion - 7
Calibrate closes the loop — proposing threshold changes and adopting them only when the eval gate certifies precision improves.
Replay the real runsc-calibrate