The chain is built. The next layer makes it learn and stay current — a doctrine foundation plus three tracks, all on the same resolved-entity substrate: the Knowledge Centre (the typology doctrine, surfaced), an AI copilot that plugs applications onto grounded context, a threat-intelligence layer that keeps the platform current, and a tuning studio that stress-tests the monitoring rules against known truth. All grounded and governed — acting on the platform's own evidence, never a free-floating model.
The estate already holds written doctrine for all 57 typologies across the analytics toolkits — every method's description, red-flag indicators, worked example and investigation actions. The Knowledge Centre curates them into a governed typology library and surfaces it in the console: an in-context slide-over from any typology chip on a case (the investigator learns why this fired without leaving it), and a standalone Knowledge tab to browse the whole doctrine by family.
It's the static half of the intelligence layer ("what each method is") to threat intelligence's dynamic half ("what's happening now"). It was cheap and near-term — the content was already written — and each library record carries an intel attachment point, so Track 2's advisories, actors and emergent typologies pin straight onto it without rework. With the doctrine built, the live intelligence has something to attach to.
The copilot isn't one model — it's a plug. For each task, an engine assembles a governed context package from the substrate (the case, the graph, the scores, the typology doctrine); an AI application acts on that package; the output comes back provenance-cited. The apps are swappable; the grounding stays constant. Three slices are live — the SAR draft, the EDD memo and disposition support — and prove the pattern end to end.
The context service is the plug; the AI applications are interchangeable behind it. That's what keeps the copilot governed and auditable: every answer traces to the same substrate, so a better model is an upgrade, not a rebuild — and nothing the copilot says is ungrounded.
Detection knows the methods; threat intelligence knows what's happening now. This layer pins intelligence to the typology library. Its architecture is the point: a curated, governed core that's deterministic. Slice 1 built the governed core; slice 2 put live regulator feeds on a weekly schedule, running as operations outside the hermetic core and entering it only through a person's decision. The return path — new indicators flowing back into detection to close the loop — is the direction.
An agent extracts a governed advisory record from regulator publications, grounded on the Knowledge Centre through its own MCP server, so every library typology it names is one the platform holds; anything outside the library is marked emergent. Each link carries a page number and a verbatim quote from the pinned document, and a quote it cannot place is refused, never queued. A second, reviewer agent adds what the extractor missed, each addition with its own justification; the owner decides every link at a review gate, and each decision is a dated line in an append-only log. Digests are cut per desk as a batch from the decided links — built, not yet delivered to a desk. Scored on a set of 20 advisories, with reference labels drafted and reviewed by Claude and the owner deciding the disputed entries: a single full-set run puts typology F1 at 0.704 once the reviewer's additions are counted. See the walkthrough →
The feeds now run. Every Friday a scheduled job reads the OFSI, FinCEN and OFAC publication listings and pins each new document. A triage agent decides which items matter, each verdict carrying a quote it found in the pinned document; slice 1's extractor then turns the relevant ones into advisory records, at most three a run, under a US$5 spending ceiling. Nothing enters the governed record on its own: a person accepts, drops or defers every item, and acceptance re-checks every citation against the pinned page. A listing whose layout changes is refused, never read as "nothing new". Triage, scored on 60 back-catalogue items over three repeats: recall 0.93–0.96, precision 0.96–1.00, with OFAC the weak source at 0.67. Three live runs so far (29 September – 2 October): 13 new items, 5 extracted, none accepted yet — the first scheduled run's three records quoted text the gate could not place on the page they named, so they wait for review rather than entering the record.
Built. 20 advisories extracted and merged, each typology grounded on a page number and a verbatim quote from the pinned document.
Live · OFSI / FinCEN / OFAC, weekly · FATF still a seamBuilt. A governed register resolves named actors by exact match only — a near-miss is only ever a labelled suggestion, never a match. The entity_key seam to the platform's resolved entities is open on purpose: synthetic data has no real party to link to.
Built. The extraction and reviewer agents can both name a typology outside the library, grounded on quotes like any other and marked emergent; the owner decides an emergent candidate at the same review gate as any other link — candidates, not automatic doctrine, and an undecided one reaches no digest.
Internal · no feed requiredBuilt. A specialism-routed briefing, cut per desk from the pinned decision log — the routing table has 7 desks, the sanctions desk gets shadow-fleet advisories, the trade desk gets TBML updates. Cut on demand; not yet delivered to a desk.
Routed · per specialist queueThe governed content is committed and byte-identical to rebuild. The regulator-bulletin adapters are now built as runtime operations outside the core, like the live Neo4j service: they fetch only from named hosts, pin what they read, and hand results to the core only through the acceptance step. Watchlist and adverse-media feeds are still seams, and the return path into detection is the direction, not yet built.
Every monitoring rule is a trade: catch more, and the queue grows past what investigators can work. The Tuning Studio runs the platform's real TM rules against a population whose truth is known (planted typologies across twelve months, seeded so every run is identical), then shows what a threshold, a segment split or a challenger rule does to alert volume, precision, recall and investigator capacity. A setting changes only through a governed, evidenced decision.
high_value threshold catches 55% of planted spikes and misses the smaller customers' ones.The studio can preview any setting against the real scorer, but it cannot change one. A change goes through a logged rationale, a version bump and the full test suite, and fails if any result moves that the rationale did not predict. Every rate is marked as planted truth, not a SAR outcome. Calibrating to real outcomes still needs a labelled history, and the studio says so.