What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Casework is a challenge-built fraud investigation prototype that combines graph evidence, retrieved policies and case history, a local language model, and deterministic policy code. Its central design choice is to make evidence, uncertainty, and approval routes visible in a structured case record—not to let an AI model decide or execute a financial action.
What Casework is designed to do
Dhruv Ghosal built Casework for the TigerGraph × HHGoa challenge. It begins with a customer, a card, and a flagged transaction, gathers connected graph evidence and relevant documents, calculates transaction signals, and assembles a case record for review. Its browser interface is intended to show case status, evidence, uncertainty, recommendations, approval routes, and report drafts.
As an Amazon Associate I earn from qualifying purchases.
The project source is available at github.com/Dhruvhash/casework-agent. The implementation walkthrough was published by Ghosal on DEV Community on September 23, 2026.
How the architecture divides the work
Casework uses a language model to help plan and review an investigation, while conventional application code calculates signals and governs what action routes are permitted. Its named components have distinct roles:
#1 Best Overall
| Component | Role in Casework |
|---|---|
| TigerGraph Savanna | Stores graph entities and relationships, document vectors, and investigation records. |
| GSQL and TigerGraph MCP | GSQL retrieves transaction context and connected evidence; TigerGraph MCP exposes graph-query capabilities to the workflow. |
| Ollama with Llama 3.2 3B | Plans retrieval, proposes permitted evidence requests, and reviews supplied evidence. |
| nomic-embed-text | Generates embeddings used for semantic retrieval. |
| Python analysis and policy modules | Calculate transaction signals, analyze graph neighborhoods, and assign action routes. |
| FastAPI and browser interface | Present cases and initiate investigations. |
In the described workflow, an investigation trigger leads to graph retrieval and transaction analysis. The model can then propose permitted evidence requests; vector search retrieves relevant policies, historical cases, and investigation memory; and the model reviews selected material. Policy code routes the recommendation, after which the application validates a structured case record and report draft and persists case information with versioned memory in the graph.
The model is constrained to structured schemas. It cannot issue arbitrary GSQL or execute financial actions, and policy code—not the model—determines the action route. This separation makes the model an investigation assistant rather than an autonomous banking operator.
How GraphRAG supports evidence review
Graph retrieval supplies transaction context and relationships; vector retrieval adds policy passages, historical cases, and generated investigation memory. The model reviews selected material with source references, returns evidence indices, and identifies remaining uncertainty. The application rejects indices that do not correspond to evidence it supplied.
Past cases are analogies, not verdicts that decide the current case. Casework also filters context against the time the case was opened, so later outcomes are not presented as evidence that would have been available for the earlier decision.
Rank #3
Attribution matters as much as connection
The underlying data does not provide a card ID for every transaction. Casework therefore uses explicit historical and trigger anchors instead of treating every transaction associated with a customer as belonging to the flagged card. That distinction prevents a customer-level link from being mistaken for proof of a card-level pattern.
- A card-testing pattern requires evidence that the transactions belong to the same card.
- A shared device profile can be a signal to investigate, but by itself does not establish fraud.
- Merchant identity and settlement status are not established in the available data, limiting conclusions about recurring merchants or cleared purchases.
What the agent can—and cannot—do
The agent can plan retrieval from current facts, propose additional evidence through permitted request types, review retrieved context, identify unresolved questions, record why it stopped, and retrieve prior investigation memory. Permitted requests include customer validation, step-up authentication, and analyst information. If an explicitly simulated response is supplied, it can update its recommendations; the workflow does not assume that more retrieval will resolve every uncertainty.
Rank #4
The prototype records evidence requests and supports simulated responses. It does not contact customers or connect to banking authorization systems. Its displayed probabilities are heuristics, not calibrated predictions from a trained fraud model. Recommendations and approval routes are shown for review; Casework does not itself block a card or submit a regulatory filing.
HHG-010: a worked investigation example
Saved case HHG-010 concerns flagged online transaction 3506725 for $1,000.03. The customer had 33 earlier transactions in the baseline, whose median amount was $68.98. The example identifies an unusual amount and a new device as signals that motivate investigation. Neither observation, alone or together, establishes whether the customer authorized the transaction.
Best Value
For the demonstration, the authors explicitly simulate a customer denial. The change in recommendations illustrates how new evidence can alter a case while retaining approval controls:
| Case state | Recommendations and route | Meaning in the demonstration |
|---|---|---|
| Before the simulated denial | VERIFY_WITH_CUSTOMER, CREATE_CASE, ESCALATE_TO_ANALYST |
Investigative steps are recommended while customer authorization remains unresolved. |
| After the simulated denial | BLOCK_CARD (L1 approval route); CREATE_CASE (automatic recommendation); FILE_REPORT (L2 approval route) |
The block remains a recommendation requiring its stated approval route; the report is a draft awaiting review. No card is actually blocked and no filing is made. |
What the saved challenge figures do and do not show
Ghosal reports 20 benchmark answer files in the project’s cases/ folder. Among the saved outputs he inspected, verdicts were 18 uncertain, one legitimate, and one fraud. These are counts of benchmark files and saved verdicts reported by Ghosal in 2026—not a measured accuracy rate. Establishing accuracy would require verified outcomes and a separate evaluation.
How to assess this design
Casework is most useful to understand as a prototype for evidence-centered investigation: it connects graph context and retrieved documents to a reviewable record, makes uncertainty explicit, and leaves action routing to policy code. The challenge example demonstrates the workflow and its boundaries, not production integration or proven fraud-detection performance.
A meaningful evaluation of a system built this way would need to examine whether evidence has reliable provenance, whether transactions are correctly attributed to cards, whether retrieval is relevant, whether uncertainty is visible, whether approval routes are followed, and whether temporal filtering prevents hindsight leakage. Most importantly, recommendations would need to be compared with verified outcomes rather than treated as validated because they appear in saved cases.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
