Use case · AML alert triage
Agent Serve gathers the account history behind every alert, drafts a masked case summary, and hands it to an investigator who decides.
An AML alert triage use case for Agent Serve, the AI workspace where teams build, deploy, and manage AI agents: a workflow receives each alert, reads account activity from tables, drafts a case summary with Guardrails masking personal data, and waits for an investigator; rules and monitors watch alert volumes.
At a glance
The problem it removes
The monitoring system raises more alerts than the team can work. For each one, an analyst opens four systems, exports the last few months of activity, and writes the same background paragraph before judging anything. Alerts age, and narratives vary from one investigator to the next.
Before and after
| Work | Before | With Agent Serve |
|---|---|---|
| Gathering evidence | BeforeExports from core banking, cards and the CRM, pasted into a case. | With Agent ServeAgent Serve reads the activity tables and attaches the evidence. |
| Writing the narrative | BeforeEach investigator writes background from scratch, in their own style. | With Agent ServeA draft follows the same structure every time, for the investigator to edit. |
| Personal data | BeforeFull account numbers copied into notes and emails. | With Agent ServeGuardrails mask personal data before the draft moves on. |
| Seeing the backlog | BeforeAlert age is checked by filtering a spreadsheet. | With Agent ServeA monitor alerts when matching alerts build up past your limit. |
How it runs
Agent Serve does the gathering and the first draft. The investigator reads, edits and decides.
The monitoring system sends the alert to an Agent Serve webhook, and the workflow adds it to the alerts table.
The workflow reads the customer’s recent transactions, counterparties and past alerts from workspace tables.
An agent writes the case summary in your template: who the customer is, what happened, and which facts point each way.
Guardrails mask personal data, then a Human step pauses the run until the investigator records a decision and a note.
In depth
Agent Serve gives investigators the evidence, a reviewer for the backlog and a record of every decision.
An Agent Serve Compliance Reviewer Relay runs when a monitor alerts, reads the alerts table and drafts a finding for a person to approve.
Agent Serve rules flag or classify transactions, and a Rule match monitor alerts once enough rows match, so the alert and the dashboard agree.
The Agent Serve Permissions step sets Observe, Assist or Operate, which actions need approval, and who approves, before a Relay touches a case.
Agent Serve writes Relay proposals, approvals and declines to the workspace audit log, and each workflow run keeps a block-by-block trace.
What does the work
A workflow takes each alert by webhook, gathers evidence and drafts the summary.
Tables hold transactions, counterparties and the alert queue, with row limits by team.
Rules flag the transactions that match each typology or threshold.
A Rule match monitor alerts when matching rows pass the limit you set.
A Compliance Reviewer Relay drafts findings when the monitor alerts.
Examples
Three financial crime queues teams run on Agent Serve, each with an investigator making the decision.
Each alert reaches an Agent Serve workflow by webhook, the customer’s history is summarized from tables, and an investigator decides.
An Agent Serve rule flags merchant transactions at or above the reporting threshold, and a Rule match monitor alerts the team.
An Agent Serve workflow drafts the case narrative from the evidence table in a fixed structure, and the investigator edits and signs it off.
Examples show what teams can build in Agent Serve. They describe patterns, not named customer deployments.
Governance
Agent Serve keeps the decision with a person, masks personal data and records what each run did.
Security and governanceThe Agent Serve Guardrails block detects personal data such as account numbers and masks it before the draft reaches the next step.
Agent Serve row limits keep each investigation team to its own alerts in tables, dashboards and exports.
Relays never send email or book meetings without an approval, under any autonomy setting. An approval covers the exact payload the reviewer saw and expires if nobody decides.
Proposals, approvals, declines and executed actions are written to the workspace audit log, which admins can export.
Every workflow run records each block’s inputs, outputs and errors, so a reviewer can trace how a result was reached.
Admin, write and read roles per workspace, plus permission groups that limit which models, blocks and integrations a team can use.
Sign in through your identity provider with SAML 2.0 or OIDC, and provision people with SCIM.
Run Agent Serve in your own cloud or data centre, next to the systems it reads.
Zero data retention with supported model providers, backed by your own provider keys and agreements or self-hosted models. Some provider features keep data by design, such as Gemini Deep Research, so they are outside zero data retention.
Use your organisation’s own model provider keys at organisation or workspace level.
Further reading
Most of an AML analyst’s day goes on collecting context, not judging it. Here is a triage setup where a workflow gathers the evidence, a Relay drafts the case and the analyst makes the call.
Retail and commercial banking · 5 min readA suspicious activity narrative is an argument built on facts. Get the facts in order first, and a model can help with the writing without ever deciding what gets reported.
Financial crime · 6 min readA card fraud desk lives on four numbers: what is waiting, how old it is, what was confirmed and what it cost. Here is a dashboard that shows all four, with rules and monitors that speak up before the queue does.
Cards and payments · 6 min readQuestions
No. In this Agent Serve workflow a Human step pauses every alert until an investigator records the decision. Agent Serve gathers evidence and drafts; people decide.
Your monitoring system can send each alert to an Agent Serve webhook, or alerts can arrive as new rows in a workspace table, which starts the workflow.
You choose. Agent Serve can mask personal data with a Guardrails step, use zero data retention with supported model providers, or run self-hosted models inside your network.
Yes. Agent Serve Logs keep each block’s inputs and outputs for every run, so a reviewer can trace which records the summary used.
A team can start with the Agent Serve triage workflow, the alerts table and a Guardrails step, then add typology rules, a Rule match monitor and a Compliance Reviewer Relay.
Last updated
Enterprise access
Agent Serve is available to teams by invitation. Tell us what you want to build and we will set up your workspace with you.