SENTINEL is a Team GOA-T project that uses TigerGraph to turn a suspicious-transaction alert into connected evidence, a policy-governed recommendation, and an explanation for an analyst. Its central design principle is: “Let the graph gather evidence, let deterministic code enforce policy, and let the LLM explain the result.” That is the team’s description of its implementation—not independent validation of a commercial fraud product.
What SENTINEL is—and what it is not
SENTINEL is a specific project created by Team GOA-T for the TigerGraph Agentic Fraud Investigation challenge. It is not a generic name for TigerGraph’s own product. The project describes an analyst-facing system that brings together graph relationships, prior investigations, deterministic fraud checks, policy rules, and generated explanations.
As an Amazon Associate I earn from qualifying purchases.
That approach goes beyond assigning a risk score to one transaction. It is intended to help an investigator examine why a transaction looks suspicious, whether related accounts or devices appear in prior cases, and what action is permitted under policy. TigerGraph separately describes fraud-investigation agents as analyzing “connected transactions, entities, and behavioral patterns”; that is the vendor’s general positioning, not evidence of SENTINEL’s performance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How the investigation workflow works
- A case begins: A risk-score alert, dispute, or analyst escalation can initiate an investigation.
- The graph adds relationships: TigerGraph queries and MCP tools gather connected context, including customer cards, card history, shared devices, transactions, and prior cases.
- Detectors and checks evaluate evidence: The system applies deterministic fraud detectors and a legitimacy checklist to assess suspicious patterns alongside possible benign explanations.
- Historical context is retrieved: Hybrid GraphRAG retrieves relevant closed cases and policy or typology context to inform the investigation.
- Policy code recommends an action: A deterministic policy engine selects a next action and approval route according to the system’s rules.
- The LLM explains the findings: An LLM synthesizes the structured findings into an analyst-facing explanation or regulatory narrative. The system can also write investigation memory back to the graph.
The project article identifies eight components: live TigerGraph Savanna Cloud with an MCP client, hybrid GraphRAG memory, eight deterministic fraud detectors, a legitimacy checklist, a deterministic policy engine, a dynamic next-best-action engine, an LLM synthesis layer, and an interactive analyst web cockpit.
#1 Best Overall
Who decides whether to block a card?
In the team’s stated design, deterministic code—not the LLM—has authority over actions and approval routes. The team says: “The LLM is deliberately not allowed to decide whether a card should be blocked or which approval route should be assigned.” The LLM’s described role is to explain structured findings in readable language, including regulatory narratives.
This division is an implementation claim made by the project authors. It should not be read as an independent security audit or proof that every deployment will enforce the boundary correctly. For an institution evaluating such a system, the practical questions are whether the policy rules are explicit, how they are tested, what actions require human approval, and how generated explanations are checked against the underlying evidence.
Rank #2
What questions can the system help an analyst investigate?
- Why is this transaction suspicious?
- Has this card interacted with other suspicious accounts?
- Is a device being used by multiple customers, or has it appeared in previous fraud cases?
- Does a transaction look unusual because of fraud, or could legitimate travel explain it?
- What action should the bank take, and does that action require human approval?
- Should the investigation generate a regulatory report?
These questions show why connected evidence matters: a shared device or link to a previously suspicious account may add context, while travel or a recurring subscription may offer a legitimate explanation that a single transaction score cannot capture on its own.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the project reports about its evaluation
Team GOA-T’s project article, published September 25, 2026, reports an evaluation using 590,742 IEEE-CIS/Vesta transactions, 5,565 historical closed cases, and 20 benchmark cases. The team also reports a live TigerGraph graph containing approximately 1.45 million transaction vertices, 20 of 20 benchmark checks passing, and a 100% policy-validation pass rate.
Rank #3
- Used Book in Good Condition
These are the project authors’ reported figures. The available project account does not establish independent replication or an external audit, so the pass rate should not be treated as proof of production fraud-detection accuracy, real-world savings, or performance across other banks and datasets. The reported benchmark and policy-validation checks describe the team’s evaluation; they do not, by themselves, establish how the system performs against changing fraud patterns or operational constraints in a live deployment.
How to assess the architecture beyond its headline results
The project description outlines a promising separation of evidence gathering, policy decisions, and explanation, but an organization assessing a similar design would need detail beyond component names and pass counts. Useful evaluation questions include:
- Relationship coverage: Which entity types and graph paths are queried, and how many relationship hops are considered?
- Historical relevance: How are prior cases and policy or typology material represented and ranked for retrieval?
- Decision authority: Which actions are fixed by deterministic rules, and what controls ensure generated text cannot change those actions?
- Uncertainty handling: Can investigators request more evidence and record legitimate explanations such as travel?
- Human oversight: Which actions require analyst review or a specific approval route?
- Evaluation quality: Are benchmark cases separated from development data, are leakage controls described, and have results been independently replicated?
How SENTINEL relates to TigerGraph’s broader fraud-investigation offering
TigerGraph’s official material markets agentic fraud-investigation use cases, and its webinar page displays vendor-presented figures such as annual fraud savings and faster case resolution. Those claims are distinct from SENTINEL’s project evaluation; they should not be attributed to the project or treated as independent confirmation of its results. The project account describes a particular challenge implementation, while vendor pages describe TigerGraph’s broader positioning.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
