LedgerLens
An AI agent system for anti-fraud scenarios that uses a graph database as a unified context layer. Through a fixed tool menu and an evidence-claim mechanism, it enables auditable fraud investigations.
Timeline (last 90 days)
The LedgerLens anti-fraud Agent does not use a vector database or hand-written Cypher queries; all memory, data, SOPs, and audit trails are stored in the same FalkorDB graph database.
Three days after LedgerLens went live, it could complete cross-session recall in milliseconds through a single full-text search and identify "old cases recurring".
The LedgerLens Agent does not write Cypher queries itself but uses a fixed menu of 26 tools, with the queries inside each tool pre-written by humans.
LedgerLens's write operations (such as freeze_account and escalate_case) create an Action node recording the operator, reason, and timestamp, linked to the case, forming an audit chain.
Each LedgerLens session ends with a JSON verdict naming one of five answer forms (with_path, from_memory, not_in_graph, unknown_entity, action), and the tool layer rejects any other form.
Each LedgerLens seed bank contains a high-value, legitimate, fully isolated negative control account, and real-time LLM tests assert that it remains untouched in every run.
LedgerLens once had a memory gap: when the investigator correctly declined to act on the negative control item, that refusal decision was not persisted as graph memory, causing the next session to re-investigate the same innocent alert from scratch.
The fix for this memory gap (commit e93909f) is: clearance results are now persisted as Finding nodes linked to the session that produced them and the related account, comprising 38 lines of code in agents.py and a 27-line regression test.
After the fix, a brand-new session can recall the refusal decision with a confidence of 0.9, along with the finding ID and timestamp.
LedgerLens uses FalkorDB graph algorithms as part of its tool menu, including algo.WCC for gang components, algo.pageRank and algo.betweenness for hubs and brokers, algo.SPpaths for up to three shortest money paths, and algo.maxFlow for funnel capacity between accounts.
3 more timeline events
All Facts (13)
LedgerLens's search_memory tool retrieves via FalkorDB full-text index, based on keyword matching and without relying on embedding models, so latency is extremely low.
50%UnverifiedThree days after LedgerLens went live, it could complete cross-session recall in milliseconds through a single full-text search and identify "old cases recurring".
50%UnverifiedThe LedgerLens Agent does not write Cypher queries itself but uses a fixed menu of 26 tools, with the queries inside each tool pre-written by humans.
50%UnverifiedLedgerLens's write operations (such as freeze_account and escalate_case) create an Action node recording the operator, reason, and timestamp, linked to the case, forming an audit chain.
50%UnverifiedEach LedgerLens session ends with a JSON verdict naming one of five answer forms (with_path, from_memory, not_in_graph, unknown_entity, action), and the tool layer rejects any other form.
50%UnverifiedEach LedgerLens seed bank contains a high-value, legitimate, fully isolated negative control account, and real-time LLM tests assert that it remains untouched in every run.
50%UnverifiedLedgerLens once had a memory gap: when the investigator correctly declined to act on the negative control item, that refusal decision was not persisted as graph memory, causing the next session to re-investigate the same innocent alert from scratch.
50%UnverifiedThe LedgerLens anti-fraud Agent does not use a vector database or hand-written Cypher queries; all memory, data, SOPs, and audit trails are stored in the same FalkorDB graph database.
50%UnverifiedAfter the fix, a brand-new session can recall the refusal decision with a confidence of 0.9, along with the finding ID and timestamp.
50%UnverifiedLedgerLens uses FalkorDB graph algorithms as part of its tool menu, including algo.WCC for gang components, algo.pageRank and algo.betweenness for hubs and brokers, algo.SPpaths for up to three shortest money paths, and algo.maxFlow for funnel capacity between accounts.
50%UnverifiedLedgerLens models each transfer as a Transaction node while maintaining two projections: TRANSFER edges aggregate transactions by ordered account pairs, and LINKED_TO edges record that two accounts share a device, address, or owner.
50%UnverifiedAll three kinds of LedgerLens memory (episodic, semantic, and procedural) are stored as graph nodes and edges: episodic memory as Session nodes with a Message chain, semantic memory as Finding nodes with a full-text index, and procedural memory as Playbook and PlaybookStep nodes.
50%UnverifiedThe fix for this memory gap (commit e93909f) is: clearance results are now persisted as Finding nodes linked to the session that produced them and the related account, comprising 38 lines of code in agents.py and a 27-line regression test.
50%