Key features

​

Core capabilities

​

Deterministic enforcement

​

Design principles

• No AI in enforcement - Rules are evaluated as compound boolean expressions (AND/OR trees)
• Reproducible results - Same data and rules always produce identical outcomes
• Audit readiness - Every violation can be traced to specific boolean conditions
• Fast execution - No API calls during rule evaluation

​

Rule execution types

{
  "type": "single_transaction",
  "conditions": {
    "AND": [
      { "field": "amount", "operator": ">=", "value": 10000 },
      { "field": "type", "operator": "IN", "value": ["DEBIT", "WIRE"] }
    ]
  }
}

{
  "type": "velocity",
  "time_window": 24,
  "threshold": 5,
  "aggregation_function": "count"
}

​

Supported operators

​

Type coercion

• "true" / "false" ↔ true / false
• "16" ↔ 16
• Numeric comparisons use parseFloat() on both sides

​

Full explainability

​

Violation components

• Policy excerpt - Exact text from regulatory document
• Policy section - Chapter/article reference (e.g., “Article 32”)
• Evidence - All field values that triggered the rule
• Threshold comparison - Expected vs. actual values
• Explanation - Natural language description generated from templates
• Confidence score - 0-1 score based on multiple factors
• Review status - Pending, approved, or false positive

​

Deterministic explanations

// Template example
`Transaction of ${amount} ${currency} on account ${account} 
exceeds the ${threshold} threshold specified in ${policy_section}. 
Transaction type: ${type}. Additional context: ${evidence}.`

• No hallucinations - Template logic is deterministic
• Consistency - Same violation type = same explanation format
• Performance - Instant generation without API calls
• Auditability - Template code is in version control

​

Signal Specificity Framework

​

Signal categories and weights

​

Minimum specificity threshold

{
  "AND": [
    { "field": "amount", "operator": ">=", "value": 10000 },        // Threshold: 0.5
    { "field": "type", "operator": "IN", "value": ["WIRE"] },      // Behavioral: 1.0
    { "field": "time_window", "operator": "<=", "value": 24 }      // Temporal: 0.8
  ]
}
// Total: 0.5 + 1.0 + 0.8 = 2.3 ✓

{ "field": "amount", "operator": ">=", "value": 10000 }            // Threshold: 0.5
// Total: 0.5 ✗ (below 2.0 threshold)

​

Implementation

1. PDF rule extraction - Gemini is instructed to combine signals
2. Rule validation - rule-quality-validator.ts scores each rule
3. Scan execution - Low-specificity rules receive confidence penalties

​

Bayesian feedback loop

​

Precision model

interface Rule {
  approved_count: number;        // User-confirmed violations
  false_positive_count: number;  // User-dismissed violations
}

​

Precision formula

precision = (1 + TP) / (2 + TP + FP)

• TP = approved_count
• FP = false_positive_count
• Priors (1, 2) provide conservative initial estimates

​

How feedback works

increment_rule_stat(policy_id, rule_id, 'approved_count')

const precision = (1 + rule.approved_count) / 
                  (2 + rule.approved_count + rule.false_positive_count);
confidence *= precision;

new_score = old_score + (severity_weight * precision_boost)

​

Transparent mapping

​

Mapping workflow

1. Upload CSV - POST /api/data/upload
2. Schema detection - Analyze headers and sample data
3. AI suggestion - Gemini maps columns to compliance schema
4. User review - View suggested mappings in UI
5. Explicit approval - POST /api/data/mapping/confirm
6. Scan proceeds - Engine uses approved mappings only

​

Example mapping

{
  "mapping_config": {
    "nameOrig": "account",
    "nameDest": "recipient",
    "amount": "amount",
    "step": "step",
    "type": "type",
    "oldbalanceOrg": "oldbalanceOrg",
    "newbalanceOrig": "newbalanceOrig"
  }
}

​

PII detection

​

Detected PII types

• Email addresses - Regex pattern matching
• Phone numbers - US and international formats
• Social Security Numbers - SSN patterns
• Names - Common first/last name dictionaries
• Physical addresses - Street addresses
• Credit card numbers - Luhn algorithm validation
• IP addresses - IPv4 and IPv6
• Passport numbers - Country-specific formats
• National IDs - Various government ID formats
• Bank account numbers - IBAN and domestic formats

​

Detection process

confidence = match_count / total_rows

​

PII findings example

{
  "column_name": "email",
  "pii_type": "email",
  "severity": "HIGH",
  "confidence": 0.95,
  "match_count": 19,
  "total_rows": 20,
  "sample_values": ["j***@example.com", "s***@test.org"],
  "suggestion": "hash"
}

​

Confidence scoring

​

Score components

score = rule_quality              // Structural quality of the rule
      + signal_specificity_boost  // Bonus for compound AND conditions  
      + statistical_anomaly       // How unusual the value vs. dataset
      + bayesian_precision        // (1 + TP) / (2 + TP + FP) from reviews
      + criticality_weight        // CRITICAL > HIGH > MEDIUM

​

Component details

precision = (1 + approved_count) / 
            (2 + approved_count + false_positive_count)

​

Score interpretation

• 0.9-1.0: High confidence violation, likely true positive
• 0.7-0.9: Medium-high confidence, review recommended
• 0.5-0.7: Medium confidence, may need investigation
• <0.5: Low confidence, likely false positive

​

Prebuilt policy frameworks

​

AML / FinCEN (11 rules)

• Currency Transaction Reports - Transactions >= $10,000
• Structuring detection - Multiple sub-threshold transactions
• Velocity limits - Transaction frequency thresholds
• Dormant account reactivation - Activity after long inactivity
• Round amount patterns - Detection of round numbers (e.g., $10,000.00)
• Balance mismatches - Balance calculation verification
• Suspicious activity thresholds - SAR filing requirements

​

GDPR (14+ categories)

• Consent management - Processing without valid consent
• Data Protection Officer - DPO requirement violations
• Encryption at rest - Unencrypted personal data
• Marketing consent - Invalid marketing communications
• Personal data handling - Excessive data collection
• Privacy impact assessments - Missing DPIA for high-risk processing
• Processing records - Incomplete Article 30 records
• Right of access - Delayed or denied data subject requests
• Right of erasure - Unlawful retention of data
• Third-country transfers - Inadequate safeguards for transfers

​

SOC2 (5 trust principles)

• Security - Logical access controls, authentication requirements
• Availability - System uptime and disaster recovery
• Confidentiality - Encryption and data protection
• Processing Integrity - Data accuracy and completeness
• Privacy - Notice, choice, and data retention

​

Custom PDF extraction

1. PDF is parsed via unpdf (serverless-compatible)
2. Gemini 2.5 Flash extracts enforceable clauses
3. Rules are validated against Signal Specificity Framework
4. User reviews and activates extracted rules

​

Next steps