Case studyFinancial services
A forward-deployed engineering case study. An AML, partner and executive intelligence system, taken from proof of concept to a production-shaped deployment, with every figure traced and every action signed.
Worlds
Ingestion
Ontology
Assistant
Workstations
The brief came from a regulated financial institution: investigators clearing alerts, partner managers watching churn, compliance reviewers, data operations and executives, each on a separate tool. The engagement started with the people who would be accountable for an answer, and worked back to the system that could give one.
| What the field showed | What was built | Capability |
|---|---|---|
| Alerts outnumber analysts, and shared infrastructure fakes connections between strangers. | Network science over devices, payment methods and timing that collapses public hubs before it calls anything a ring. | Network science |
| Leadership could not tell a cause from a coincidence, so every countermeasure was a guess. | A fitted causal graph whose edges must survive refutation, and a what-if that says Correlation Only the moment it leaves the history. | Causal inference |
| Money moves through geography, but geography is easy to read as a verdict about people. | Map lenses on corridors, shared exits and login countries, published lists as evidence, and a refusal to rank anyone by origin. | Financial geospatial |
| Generic copilots invent numbers and act without authority. | One agent per workstation that may cite only what a tool returned in the same turn, and can only propose. | Agentic AI |
| A decision nobody can replay is a liability in front of a regulator. | Signed, expiring intents, four-eyes approval and a hash-chained ledger that replays the evidence behind every action. | Governed action |
Seeded synthetic worlds that plant the truth: laundering rings, churning partners, a causal chain. Evaluations read the answer key. No engine ever does.
Client activity is synthetic and planted; the reference layer is real public data: Overture, FATF, EU, Basel, ICIJ, World Bank, IPinfo. BY DESIGN
Every figure below is drawn from the running engines or from recorded live turns. Try to break them.
Accounts are linked through shared devices, payment methods and matched timing. A public gateway touches hundreds of strangers; left in the graph, it fuses them into one false ring. Hubs past degree 100 are collapsed before anything is called a ring.
Runs onBigQuery GraphBigQuery
Generated image, not a satellite photograph.
The sixth workstation reads the book through four lenses and three published lists. Its own Gemini agent answers questions and moves the map, but only to objects a tool returned in the same turn.
Pick a question to replay the agent's answer and its map move.
Loading the map…
Flows: geo engine over the seeded book, 6,000 accounts, 1 hub suppressed, as of 2026-10-14. Lists: FATF (June 2026), EU Delegated Regulation 2016/1675 as amended, Basel AML Index 2025. Centroids: Overture Maps. Outlines: Natural Earth.
Triage
Rings and alerts ranked by the engine's score, filterable by severity.
Evidence dossier
Why the case was raised, every figure with a citation and its geography flagged.
Network graph
The ring around CR84920 with public hubs past degree 100 collapsed.
Entity inspector
Centrality, 30-day velocity and the counterparties, by volume.
SAR composer
A near-final narrative drafted from the same evidence.
Governed action shelf
Staged and expired intents; nothing executes without a second approver.
Agents and workstations sit above the governed tool port; data, engines and the systems that can change state sit below it. Nothing crosses the middle except through a typed, role-scoped, traced call. Select any component, or trace a request end to end.
Workstations
Agents · Google ADK
Gateway + APIs
Ontology · governed tool port
Data sources
Logic · engines
Systems of action
runs on a Google Cloud service
Every row is a result our own harness produced against what the synthetic worlds planted, not production traffic. The first live run found a bug in our own grader, so the judge was fixed and frozen before the sealed split ran once.
200 pass, 13 fail, 0 inconclusive over 246 turns. 96.8% of figures supported. p95 4.8 s, no timeouts. MEASURED
figures supported, of 100%
The gate is not proven: 19.7% of turns ran on fixture data.
40 pass, 2 fail over 42 turns. 97.8% of figures supported. p95 10.3 s. MEASURED
figures supported, of 100%
One wrong tool route and one judge false positive on a hash. 11% of turns ran on fixture data. Not tuned against afterwards.
11 of 11 breaches quarantined, 0 healthy events refused, 2,818 events. MEASURED
11 of 11 planted breaches quarantined
The breach rate was about eight times the 0.05% circuit-breaker budget, so the board reads DEGRADED.
Largest coefficient error 1.5% on the default world, within 4% across forty other seeds. MEASURED
largest coefficient error, 0 to 5%
Refuters cannot see confounding. The adjustment set is a domain input. One seed in forty accepted the null.
Error 0.74 times that of carrying today's value forward. 90% interval held 87% over 75 origins. MEASURED
error against carrying today forward, lower is better
90% interval: share of outcomes inside, 80 to 100%
Interval slightly under-covers.
Under 1 ms on the default world. Attribution sums to 100.00%. MEASURED
propagation time, 0 to 200 ms
200 ms budget.
Precision 1.00 and recall 1.00 on six planted exits, the same on five unseen seeds. MEASURED
precision, 0.80 to 1.00
Without hub suppression the VPN country becomes a seventh and precision falls to 0.86.
Ranks well (AUC 0.974) but overstates: mean hazard 0.43 against 0.21 observed. MEASURED
hazard, 0 to 0.6
The order is trustworthy. The probabilities are not, and the workstation says so.
15 of 15 passed their string assertions. MEASURED
15 of 15 probes passed
Small set, no LLM grader, one run.
They are checked as tests and, where a probe is safe, against the running system. Two cannot be probed live without writing state or faking an outage, and the operations board says so instead of showing green.
No model computes a metric.
Every number comes from a deterministic engine. A briefing recomputed twice is identical.
No autonomous write-back.
Agents propose. A signed, expiring intent needs a second human.
Honest uncertainty.
A claim shows as causal only past a placebo test and a confidence floor. Otherwise it reads Correlation Only.
Shared-IP hubs are collapsed.
Nodes past degree 100 cannot make a laundering ring. The largest detected ring is no bigger than the planted one.
The decision ledger cannot be rewritten.
Monotonic sequence numbers and a SHA-256 chain on every approval, walked end to end.
What-if is fast and adds up.
Shocks propagate well inside 200 ms and attribution closes to 100.0%.
An outage is stated, never invented.
Workstations serve a labelled replay. The copilot never replays: its outage is a plain 503.
The grader reported 37.0% faithfulness. A spot check showed the grader was wrong, not the copilot: it misread bullet lists. The fix stayed as a regression test.
It answered a churn probability of 0.84 while the screen showed 0.78, because a tool returned the same constants for every partner. Per-entity data removed the disagreement.
Almost a third of turns missed a 60 s deadline. The time was the final drafting call, not hangs. Moving to the ADK assistant with a plain-figures assembler removed the tail. The case sets differ, so read the direction and not the ratio.
The churn model orders partners well and overstates every probability. Recalibration against observed outcomes is the remedy, and until then the workstation does not present the figure as a probability.
Worlds, ingestion, the ontology and the assistant. Each can only be reached through the one beneath it.
Reviewer accounts are on the sign-in page. Client activity in the workstations is synthetic; the reference layers and regulatory documents are real and public.