FND005 · Network Intelligence
Of everything the platform has produced, what should an investigator open first, and why that?
FND005 Investigation Workflow Intelligence is the foundation capability that converts scored intelligence products into a ranked work queue, combining risk, confidence, exposure, materiality and complexity into a priority score, a band, named drivers and a queue assignment.
FND004 answers how risky. FND005 answers what first. A high risk finding nobody can evidence and a moderate one that is fully evidenced are ordered differently here, on purpose.
Five weighted components are combined and capped at a hundred. The weights are defaults on the prioritisation weights object and are injectable at construction:
Risk 0.35
Confidence 0.20
Exposure 0.20
Materiality 0.15
Complexity 0.10
The weights sum to 1.00.
Confidence carries a positive weight, which is a stated design choice and the opposite of a triage model that surfaces the least certain items for adjudication. The better evidenced a finding, the sooner it is reviewed, so a high risk low confidence finding sits below a moderate well evidenced one. That ordering is intended, but it must be understood, because it is where this product most differs from FND004.
Confidence is normalised by multiplying any value at or below one by a hundred, because upstream products report confidence on both a zero to one and a zero to a hundred scale. The test is magnitude, not provenance, so a product legitimately reporting a confidence of one out of a hundred is rescaled to the maximum. Any product feeding this engine should report confidence on the zero to one scale, where the rule is unambiguous.
Where a product supplies no exposure score, exposure takes the value of the risk score. The risk figure then carries the risk weight and the exposure weight together, which is fifty-five percent of the priority, and the queue becomes over half an echo of one number. Nothing in the output records that this happened. Check whether the product carried an exposure score before reading the priority as a five component judgement.
Materiality behaves the same way more visibly. Absent, it contributes a neutral fifty, which is seven and a half points of priority awarded for having no materiality data at all.
Where no complexity score is supplied it is derived from network shape: size times three capped at forty, relationship count times one and a half capped at forty, and ownership depth times seven capped at twenty. Complexity is the cost of investigating, and it is weighted positively, so a complex network is prioritised higher rather than deferred as expensive.
Scores are banded and routed to a queue:
85 and above Critical, Priority 1 Investigation Queue
70 to 85 High, Priority 2 Investigation Queue
50 to 70 Medium, Standard Review Queue
30 to 50 Low, Monitoring Queue
Below 30 Very Low, No Immediate Action Queue
The bands are identical to FND004's. The same thresholds over a different quantity: a critical priority and a critical risk are not the same claim, and the shared vocabulary invites conflating them.
Priority drivers are emitted in evaluation order. Unlike FND003 and FND004 the list is neither sorted nor deduplicated, so its order is stable but carries no ranking:
Critical risk score, at eighty-five or above
High risk score, at seventy or above
High confidence finding, at eighty-five or above after rescaling
Large connected network, at ten entities or more
Complex ownership structure, at depth three or more
Connected high-risk entities, at one or more
High-value network intelligence product, by product type
Critical investigation priority, at eighty-five or above
Curated from fc-03-network-intelligence-library/intelligence-products/specific/FND005/README.md