Watch the Market, Not the User

Role

Product designer. I designed aggregate monitoring, the investigation workflow, scoped access, and the evidence trail.

Workflow

Transaction monitoring: identify unusual activity, explain its character, and justify the smallest necessary investigation before a case or SAR decision.

Data coverage

8 channels, 182 days. 5 conventional rails and 3 digital-asset rails.

Verification

The shared model checks alert counts and rule behavior. The analyst evaluation compares disposition quality and identity access.

Related products

NICE Actimize and Nasdaq Verafin connect monitoring signals to investigations. This workspace makes the scope and reason for individual access part of that decision.

1. Is something unusual, by a rule I can state?

2. Is it broad or concentrated?

3. Does it justify a look at an individual, and how small can that look be?

Notice at the aggregate · read its character · decide the smallest look · record it.

From signal to a justified investigation

Read the decision flow

1. Notice an unusual channel
2. Compare value and participation
3. Explain the aggregate or inspect a pseudonym
4. Request only the identity scope needed
5. Record the disposition and re-mask

Data

Random data on every load became a seeded dataset with designed events.

Names

Protocol brands became channels a bank payments desk runs.

Rule

Mean + 2.5 SD over the visible window became a calendar-adjusted MAD rule using 28 prior days. The old rule raises 6 month-end false alarms. First drift flag under the old rule: never; under the revised rule, day 2. Narrowing the view leaves 0 drift days flagged under the old rule. The revised flags stay fixed.

Encoding

Recolored anomalies that lost their magnitude became outlined cells that keep it.

Premise

No zero-knowledge proof is implemented. I designed the analyst’s side of a world where aggregates arrive with a validity guarantee.

Fig. 04

2 rules, 1 grid

Open prototype ←

The original rule is still inspectable. Change the range to see which threshold moves with the view.

Monitoring analyst

Alerts they can explain without opening a customer file.

Monitoring lead or desk head

System-level escalations that cross rails, early.

Privacy officer

Evidence that identity access is rare, scoped, and logged.

Model risk

A stated rule, its sample size, and its known failure modes.

Internal audit

An append-only record of every look and every disposition.

Insider-risk monitoring

Team-level patterns first; an individual employee only with a logged reason.

Public health surveillance

Case counts by area; a patient record only under a stated purpose.

Platform trust and safety

Abuse rates by surface; an account review only with a ticket.

AI agent fleets

Anomaly rates across sessions; a session replay only with a reason.

Friction before identity

I accept slower individual investigations in exchange for fewer unnecessary looks and a record that shows it.

A robust rule over a simple one

I accept a harder explanation in exchange for a threshold that handles these calendar peaks and catches this drift. Both rules remain inspectable; the robust rule can still adapt to persistent drift.

Persistent pseudonyms

A behavior pattern without a name is still information. I accept that exposure because it lets the analyst escalate without identity.

Participants

6 to 8 transaction-monitoring analysts and leads.

Task

Work the full alert queue in this workspace and in a baseline where identities are visible by default. Counterbalance the order.

Measures

Correct dispositions against the reference readings, identity views per alert, counterparty-days revealed, time, and a blind rating of each justification.

Pass line, set before any session

Dispositions at least as accurate as the baseline, fewer identity views, and no missed system-level event (E4).