Alert Triage Agent
Reviews and dispositions transaction-monitoring alerts.
Reads each alert, pulls the customer and counterparty context, applies the typology playbook, and dispositions noise alerts with a written rationale built for regulatory review. Escalates the ambiguous remainder to the investigation agent with the enrichment already attached.
Authority
Act within policy
Team role
Routes work to specialists
Handoffs
Named collaborators
The role
What it owns and where its authority ends
Desk
Transaction Monitoring
Desk workflow
Alert generation, then triage, enrichment, and disposition (close or escalate), then case creation. The triage agent runs the full loop continuously.
Collaboration
Calls several specialists in parallel
Decision boundary
Acts only within an explicit policy, permission and escalation boundary.
Systems and capabilities involved
Case management system
read/write alert + case state
Core banking + payments API
transaction history, counterparties
Adverse-media / KYC retrieval
screening corpus reference library
Graph queries (entity resolution)
Escalation to investigation agent
Handoffs
What this role gives and receives
Capabilities offered
The handoffs name the next owner or specialist and the work that moves between them.
Handoff to
Receives from
Context
What the role needs to do the work
- Current work
- Per-alert scratchpad: hypotheses, evidence pulled, current disposition lean.
- Prior interactions
- Prior alerts on the same customer/counterparty cluster.
- Policies and reference
- The bank's typology library and disposition policy.
- Working method
- Learned disposition playbooks refined from judge-agent overrides.
Illustrative workflow
How the work moves
Starting point
Structuring alert: 9 cash deposits just under $10k across 3 branches in 5 days.
- 01
Resolve the entity graph: same beneficial owner behind the three accounts?
- 02
Pull 13-month transaction history; compare to the customer's expected profile.
- 03
Check adverse media + prior alerts on the cluster.
- 04
Score against the structuring typology; draft rationale.
Result
Escalates to the SAR desk with a pre-built packet: structuring pattern confirmed, expected-activity deviation quantified, narrative stub attached.
Checks and boundaries
What must be tested or reviewed
- 01Agent-as-judge sampling of closed alerts; precision/recall vs. a confirmed-case gold set.
- 02Hard guardrail: cannot auto-close above a risk-score threshold; escalation is forced.
- 03Full decision trace of every tool call retained for control-plane audit.
- 04Monthly typology-drift detection against newly confirmed cases.
Human authority
Acts only within an explicit policy, permission and escalation boundary.
Keep exploring