Risk scope
Define institution, products, customers, geographies, channels, threats, risk appetite, and applicable obligations.
MUST CLOSE BEFORE ADVANCEMENTCAPABILITIES / ANTI-MONEY LAUNDERING
CAP–A06EVIDENCE-BOUND SYSTEM ARCHITECTURE
Move from alert volume to evidence-weighted investigation.
KAIA–ZUR can organize authorized customer, account, transaction, ownership, device, geography, adverse event, typology, and case evidence into a temporal graph while preserving uncertainty, policy, investigator judgment, and reporting authority.
ARCHITECTURE STATEOBLIGATIONS TYPED
- 01Risk scope
- 02Evidence
- 03Investigation
- 04Governance
An anomaly is not a crime, a link is not intent, and a model score is not a legal conclusion. The system must help investigators assemble and challenge evidence without automating suspicion into guilt.
DECISION CONTRACT
Bound the capability before listing the features.
Every workflow begins with an explicit decision contract that determines system behavior and acceptance evidence.
Evidence
Resolve entities, ownership, transactions, devices, events, typologies, source quality, and chronology.
MUST CLOSE BEFORE ADVANCEMENTInvestigation
Preserve hypotheses, counterevidence, disposition reasons, quality review, escalation, and case authority.
MUST CLOSE BEFORE ADVANCEMENTGovernance
Measure detection value, false positives, bias, workload, timeliness, explainability, privacy, and change.
MUST CLOSE BEFORE ADVANCEMENTINTERACTIVE RUNTIME SPECIFICATION
Input, transformation, output, control, and failure—at every layer.
Select a layer to inspect how the architecture transforms evidence and which failure must trigger abstention.
AML1 / Identity + ownership
Resolve the subject before evaluating the behavior.
Customer and counterparty records, beneficial ownership, accounts, devices, addresses, corporate registries, and authorized third-party data form a confidence-scored identity graph with conflict retained.
INPUTKYC · accounts · ownership · identifiers
→TRANSFORMATIONIdentity + ownership
→OUTPUTResolved party network
- ACTIVE CONTROL
- Lawful use + source + confidence
- FAILURE TO PREVENT
- False identity consolidation
OPERATING PATTERNS
One capability. Different decisions and failure boundaries.
These patterns are notional architectural scopes—not claims about customers, deployments, or outcomes.
Alert triage and contextualization
Enrich alerts with party, transaction, network, product, geography, history, and typology context.
- DECISION
- Which alert merits investigation, consolidation, or closure?
- GOVERNANCE BOUNDARY
- Disposition requires institution-defined policy and human review
Network and beneficial-ownership analysis
Expose evidenced and inferred connections across people, entities, accounts, devices, addresses, and flows.
- DECISION
- Which relationship changes the risk hypothesis?
- GOVERNANCE BOUNDARY
- Association is not proof of control, intent, or offense
Case investigation workspace
Maintain chronology, evidence, hypotheses, counterevidence, requests, decisions, and review in one traceable record.
- DECISION
- Is the case sufficiently supported for escalation or closure?
- GOVERNANCE BOUNDARY
- Authorized investigators and reporting officers decide
Program effectiveness
Compare risk coverage, alert yield, quality, timeliness, workload, false positives, drift, and control gaps.
- DECISION
- Which control change improves risk-based effectiveness?
- GOVERNANCE BOUNDARY
- No universal threshold or regulatory outcome is implied
GEO-SEMANTIC TWIN
Interrogate location, relationship, state, and authority on the same surface.
The 2D/3D scene uses explanatory notional data; locations do not represent customers, facilities, or real operations.
KAIA / GEO-SEMANTIC TWINExplanatory operating topology
PUBLIC-SECTOR PATTERNMission ContinuityMODELED
NOTIONAL · EXPLANATORY · NO CUSTOMER/OPERATIONAL DATAASSURANCE EVIDENCE LEDGER
A claim is only as strong as the boundary of its evidence.
Each assurance domain requires an explicit owner, method, scope, result, exception, and residual risk.
Risk-based scope
Institutional risk assessment connects threats, vulnerabilities, products, channels, customers, geography, and controls.
EXPECTED EVIDENCERisk assessment · coverage map · control rationale
Data + model governance
Lineage, quality, validation, calibration, bias, privacy, access, and change are managed.
EXPECTED EVIDENCEData controls · validation · change approval
Investigation quality
Evidence sufficiency, counterevidence, consistency, reviewer challenge, and filing authority are measurable.
EXPECTED EVIDENCECase QA · disposition taxonomy · reviewer record
Program learning
Outcomes, feedback, typology change, drift, missed risk, and remediation update the control environment.
EXPECTED EVIDENCEEffectiveness review · issue log · tuning record
The system must not advance to action before reality passes type-checking.
Change the controls to inspect how evidence, authority, and environment stress alter admissibility.
ILLUSTRATIVE INTEGRITY INDEX77
CONDITIONAL REVIEW
- Thresholds satisfied; authorized human decision remains required.
This interaction is deterministic and explanatory.
NEXT DECISION
Bring the risk hypothesis, evidence gaps, and investigator workload.
Map institutional risk, sources, entity model, typologies, case workflow, human authority, effectiveness measures, and regulatory boundary.