Home · Work · System design
Financial crimeEvent-driven evidence investigationfederated

Mule-account network triage

Individual accounts can look ordinary while transaction timing, counterparties and device reuse reveal coordinated movement across a network.

Approach

A temporal graph engine proposes clusters, separates observed edges from inferred links, and ranks cases by evidential completeness and potential harm.

Organisations, systems and operating conditions are intentionally anonymised and recomposed. The design demonstrates engineering and banking-domain reasoning; it does not represent a named client estate, vendor product or measured production result.

Overview

System overview

A shared authority core coordinates independently owned capability cells, domain systems and operating evidence.

Mule-account network triage: federated system architecture A federated architecture separates channels, a shared authority core, independently deployed capability cells, domain systems of record, and an evidence and operations rail. Calls use scoped identity and typed contracts; every decision path emits a receipt. aSystem boundary and decision authoritySchematic architecture · illustrative scenario Channels and operatorsFederated capability cellsDomain systemsEvidence, recovery and operations Customer channelweb · mobile · voice Staff workspacereview · approve Service eventbatch · stream · API Operations consoleincident · replay Scope & authority coreidentity · purpose · policy Domain adapter meshversion · health · readback Party RelationshipResolverIdentity & relationshipsReasoning Route ManagerModel executionBehaviour EvaluationHarnessEvaluation & releaseOperational Read ModelWorld state & read modelsDecision Receipt LedgerEvidence & auditAuthority Rules EngineAuthority & policyEvidence ContextCompileravailable, not admittedJourney StateCoordinatoravailable, not admittedTyped Action Brokeravailable, not admittedScreening engineauthoritative recordcustomer masterauthoritative recordrelationship graphauthoritative recordexternal registersauthoritative record Decision receipt archiveappend-onlyTrace & cost pipelineredacted telemetryRecovery & custody queueowned exceptionsRelease & rollback registrysigned manifest
Figure 1. Independent capability cells share an authority membrane without sharing domain ownership. Source-specific behaviour remains behind adapters and every decision emits operating evidence. This is an illustrative system model, not a named deployment.

Permitted workModels may extract, compare and propose hypotheses. Deterministic policy gates and trained investigators own risk classification and disposition.

Consistency rulePin policy, list and evidence versions per case; retain contradiction and non-match evidence as well as supporting evidence.

Hard boundaryThe model is not a system of record, identity provider, policy authority or proof that an external effect occurred.

Deployment

Deployment

An alert or case requires evidence fan-out, deterministic triage, residual model reasoning and a defensible human disposition.

Mule-account network triage: deployment and trust-zone topology A production topology separates public edge, identity boundary, workload cluster, integration plane, data enclave and operating controls. Connections name transport and identity protocols, and a second region provides controlled failover. bDeployment topology and failure domainsLogical deployment · no measured estate data EDGE AND ACCESS PRIVATE WORKLOAD CLUSTER INTEGRATION AND DATA ENCLAVE OPERATIONS, EVIDENCE AND RECOVERY PLANE Web applicationfirewallTLS · bot · rate API ingressschema · quota Identity brokerOIDC · MFA Purpose gateclaims · consent HTTPStokensubject Regional traffic managerhealth · canary · failover Workload identity issuershort-lived service tokens Event & work queuepartition · DLQ · backpressure Secrets & key serviceenvelope encryption · rotation PartyRelationship…zonal workloadAuthority RulesEnginezonal workloadDecision ReceiptLedgerzonal workloadReasoning RouteManagerzonal workloadBehaviourEvaluation…zonal workloadOperational ReadModelzonal workloadReserved workloadslotdisabledReserved workloadslotdisabled HTTPS · scoped JWT workload token async eventkey lookup IntegrationgatewaymTLSScreening enginesystem of recordcustomer mastersystem of recordrelationship graphsystem of recordexternal registerssystem of record Model route enclavepolicy · schema · egress Qualified data storesSQL · graph · object Trace, metric & cost pipelineOpenTelemetry · redaction Decision receipt archiveappend-only · retention Reconciliation workersreadback · replay · DLQ On-call & review queuescustody · SLA · escalation Secondary-region standbycompatible manifest telemetryreceiptsexceptions
Figure 2. Workloads remain isolated from systems of record. Short-lived identity, typed integration contracts, append-only evidence and controlled failover define the deployable boundary; the topology is schematic.
Authority checkpoint

Cluster membership is an investigative lead, not an adverse decision; action requires independent policy evidence.

Runtime

Runtime flow

A deterministic outer workflow contains model-led work inside typed, observable calls. Dashed messages remain proposals until policy or a human grants authority.

Mule-account network triage: event processing and recovery flow A five-lane event architecture shows authoritative producers, admission and ordering, evidence qualification, decision and effect handling, and the recovery rail. Late, duplicate and failed events follow separate paths to reconciliation and replay. cRuntime protocol and control pointsProtocol model · illustrative execution Authoritative producersAdmission and orderingEvidence and decisionEffect and reviewEvidence, reconciliation and replay Screening engineevent time · source versioncustomer masterevent time · source versionrelationship graphevent time · source versionexternal registersevent time · source version Schema gateversion · identity · duplicatePartitioned event logentity key · watermark Enrichment workersbounded fan-out · freshnessDecision workerrule gate · bounded score Effect or review routetyped action · custodyOutcome verifierreadback · reconcile source eventsource eventqualified readqualified read admittedorderedcontextdecision Late-event correctionreopen · append · notifyDead-letter queuefault class · ownerIdempotent replaysame key · checkpointDecision receipt ledgerversions · basis · custodyOutcome monitorlag · drift · harm invalid / faileddelayed outcomecheckpoint replaydecision evidenceeffect receipt Consistency: Pin policy and evidence versions at case open. Later corrections append and may trigger reassessment; they do not rewrite the historic basis silently.
Figure 3. Event time, admission, evidence qualification, decision and delayed outcome remain separate. Late or failed events enter correction and replay paths with preserved lineage. The paths are protocol semantics, not an observed production trace.
S

State model

Append-only case events feed a current-state projection. Evidence rows keep source, observation time, validity, correction history and narrative usage.

I

Integration choice

Use asynchronous ingestion and bounded parallel reads. Slow providers have independent timeout and circuit-breaker policy so one source cannot exhaust the case tier.

C

Consistency semantics

Pin policy and evidence versions at case open. Later corrections append and may trigger reassessment; they do not rewrite the historic basis silently.

Services

Services and interfaces

These roles are deliberately vendor-neutral. Each can be independently owned, versioned and replaced.

  1. ERG
    Identity and relationships

    Party Relationship Resolver

    Returns candidate entities and typed relationships with match features, contradictions, effective dates and non-merge evidence.

    Degraded routePreserve separate candidates and route ambiguity for review. Never collapse entities simply to complete the journey.
  2. MSG
    Model execution

    Reasoning Route Manager

    Chooses an approved model route by task, risk, evidence quality, latency budget and cost ceiling; enforces structured outputs.

    Degraded routeUse a smaller certified route, deterministic fallback or human queue. Never lower the control bar to meet latency.
  3. SEL
    Evaluation and release

    Behaviour Evaluation Harness

    Runs component, route, trajectory, failure, harm and outcome tests against the versioned system manifest.

    Degraded routeReduce or withdraw authority when a dependency changes or a critical suite fails; preserve the last approved route where compatible.
  4. OSR
    World state and read models

    Operational Read Model

    Builds time-qualified projections from source events and reconciliations without becoming the legal system of record.

    Degraded routeExpose source lag and fall back to direct reads for defined critical facts; never present missing feeds as zero.
  5. DES
    Evidence and audit

    Decision Receipt Ledger

    Appends request, versions, policy result, model proposal, approval, action receipt, readback, correction and custody events under one correlation key.

    Degraded routeBlock a consequential close when mandatory evidence is missing; keep the case open with an explicit evidence defect.
  6. PDS
    Authority and policy

    Authority Rules Engine

    Evaluates identity, purpose, capability, amount, risk tier and policy version; returns allow, deny, step-up or human-review with reasons.

    Degraded routeFail closed for effects and restricted data. Read-only explanation may continue only from approved public or customer-visible sources.
Figure 4. Each service exposes a typed contract and a defined degraded route. Coordination stays in the control plane while domain ownership remains outside it.
Data

Data and records

Durable records carry provenance, authority, effect and custody without turning a transcript into an uncontrolled memory store.

Mule-account network triage: state ownership and evidence lineage Authoritative source observations feed six versioned runtime records. Each record names a single write owner. An append-only event and evidence stream builds a disposable current-state projection and supports audit replay. dState lineage, ownership and temporal validityLogical records · fields are illustrative AUTHORITATIVE INPUTS · POINT-IN-TIME QUALIFIEDScreening enginesource version · observed atcustomer mastersource version · observed atrelationship graphsource version · observed atexternal registerssource version · observed atqualified inputqualified inputqualified inputqualified input WRITE OWNER · Evidence Context CompilerRequest enveloperequest_idpurposeactor_refsubject_refversioned · attributable · retainedWRITE OWNER · Authority Rules EngineContext manifestcontext_idsource_refsource_versionobserved_atversioned · attributable · retainedWRITE OWNER · Typed Action BrokerCase statecase_idstatestate_versioncurrent_custodianversioned · attributable · retainedWRITE OWNER · Reasoning Route ManagerAuthority decisiondecision_idpolicy_versionrequested_capabilityoutcomeversioned · attributable · retainedWRITE OWNER · Behaviour Evaluation HarnessAction and effect receiptaction_ididempotency_keyinput_hashdispatch_statusversioned · attributable · retainedWRITE OWNER · Operational Read ModelCustody eventtransfer_idfrom_ownerto_ownerreasonversioned · attributable · retained APPEND-ONLY CASE EVENTS + DECISION RECEIPTSrequest hash · source versions · policy version · proposal · authority · effect readback · custody Operational current-state viewrebuildable projection
Figure 5. The record chain preserves source version, write ownership, authority and custody. Solid records are required in this scenario; dashed records remain compatible but dormant.
Consistency contractDomain source rule

Pin policy, list and evidence versions per case; retain contradiction and non-match evidence as well as supporting evidence.

Choices

Trade-offs

The selected design is not universally superior. It is the safer fit for this boundary and failure cost.

  1. 01

    Optimise for fewer duplicate entities or fewer false merges

    Selected path

    Bias consequential journeys against false merge and retain unresolved candidates.

    Rejected path

    Automatically merge the highest-scoring candidate.

    Cost acceptedMore cases require clarification, but one person's authority or risk cannot silently attach to another.

  2. 02

    Use one frontier model for every step or a task-specific cascade

    Selected path

    Reserve larger models for residual reasoning after deterministic and smaller-model gates.

    Rejected path

    Send every request to the most capable available model.

    Cost acceptedRouting adds evaluation work and operational complexity, but controls cost, latency and unnecessary data exposure.

  3. 03

    Evaluate model responses alone or certify the complete reachable system

    Selected path

    Test prompts, models, tools, knowledge, policies, state transitions and human paths together.

    Rejected path

    Use a static answer-quality benchmark as the release gate.

    Cost acceptedSystem evaluation takes longer and needs synthetic environments, but detects authority and recovery failures that answer scoring misses.

  4. 04

    Query every source in the critical path or maintain operational read models

    Selected path

    Use event-fed projections for scale and direct readback for consequential effects.

    Rejected path

    Fan out to all systems of record for every interaction.

    Cost acceptedRead models introduce lag and reconciliation work, but reduce source load and make cross-system views feasible.

  5. 05

    Mutable current-state record or append-only decision history

    Selected path

    Use append-only events plus a rebuildable current-state projection.

    Rejected path

    Overwrite the case row with its latest status.

    Cost acceptedReplay and storage are more complex, but point-in-time reconstruction and correction lineage remain possible.

  6. 06

    Reason over policy text at runtime or compile executable rules

    Selected path

    Compile stable decision logic and retain retrieval for explanation and residual ambiguity.

    Rejected path

    Ask a model to interpret the source document for every request.

    Cost acceptedRule compilation needs controlled change, but creates repeatable decisions, regression tests and clear exceptions.

Figure 6. Teal marks the selected route; coral dotted rules preserve the rejected alternative. Each decision states the cost accepted rather than presenting one architecture as universally superior.
Recovery

Failures and recovery

Retries are bounded by knowledge of business effect; unknown outcome remains visible, owned and independently reconciled.

Mule-account network triage: failure classification and recovery control flow Five failure sources converge on a classifier that distinguishes known no effect, known failure, unknown outcome, material evidence gaps and control-plane failure. Each state has an explicit recovery route, service degradation and evidence receipt. eFailure classification and recovery policyControl model · thresholds set by owners DETECTION POINTSEFFECT CLASSIFIERRECOVERY DECISIONSERVICE-SPECIFIC DEGRADATION Source dependencyShared infrastructure or legitimate…Authority servicePolicy is unavailable, expired, or returns…Reasoning routeOutput fails schema, citation, grounding…Action pathTransport times out after dispatch & the…Evidence railReceipt or custody append fails after a… Outcome classifierattempt · idempotency · source readback ·… Known no effectSafe bounded retry with the same…Known failureNarrow, queue, compensate, or fail closed…Unknown outcomeRead back authoritative state before retry…Material evidence gapRetain custody & create an owned…Control-plane failureStop promotion or dispatch; restore the…Party Relationship ResolverPreserve separate candidates &route ambiguity for review. Nevercollapse entities simply to…Reasoning Route ManagerUse a smaller certified route,deterministic fallback or humanqueue. Never lower the control bar…Behaviour Evaluation HarnessReduce or withdraw authority whena dependency changes or a criticalsuite fails; preserve the last…Operational Read ModelExpose source lag & fall back todirect reads for defined criticalfacts; never present missing feeds…Decision Receipt LedgerBlock a consequential close whenmandatory evidence is missing;keep the case open with an… RECOVERY RECEIPTfault origin · classification basis · owner · retry/compensation key · readback reference · residual risk · resolved at classifier evidencerecovery evidence Pattern rule: Missing materialevidence blocks a clean close. Thecase enters a completeness queue…
Figure 7. Recovery follows the known business-effect state, not the transport symptom. Every branch ends in a receipt preserving fault origin, custody and reconciliation basis.
Capacity

Performance and capacity

Actual thresholds belong to accountable service owners. The design exposes the equations and observables that those owners must baseline.

Dependent variablesOperating
envelope
  • recall and false-close rate
  • case-pack latency
  • source completeness
  • investigator queue age
Capacity relationships
  1. 01peak_enrichment_qps = peak_case_rate x sources_per_case
  2. 02review_hours = residual_cases / investigator_throughput
  3. 03evidence_storage = cases x evidence_rows x retention_window
Privacy lens

Tokenise identity before model use, restrict sources by investigation purpose and retain only policy-required evidence.

Figure 8. The variables define what must be measured before capacity or quality claims can be accepted. Relationships are analytical scaffolds, not invented targets or production results.
Operations

Release and operations

A design is production-ready only when teams can prove what happened, recover it and change it safely.

Minimum release gates
  1. 01

    false-merge and false-split test

  2. 02

    source outage and incomplete-case test

  3. 03

    blind sample of deterministic closes

  4. 04

    investigator override drift review

Figure 9. Promotion requires evidence at each gate and a compatible rollback route. No gate is implied to have passed; accountable owners set thresholds and sign the record.
Operating stateReleaseRecover
Evidence

Edge provenance, temporal windows, alternative explanations, feature contributions, case linkage and reviewer action.

Human authority

Investigators decide case linkage, customer impact and external reporting.

Evolution

Use shadow decisions and blind samples before allowing deterministic closes. Keep agent-touched cases under human disposition until operating evidence supports narrower review.

Ownership

Investigation, policy, data, model-risk and operations owners retain decision and control accountability.

Figure 10. Evidence, human authority, ownership and controlled evolution remain coupled throughout operation. Removing any quadrant breaks the assurance case.