{"slug": "caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on", "title": "CaseGuard: Winning with Uncertainty-Gated Agentic Fraud Investigation on TigerGraph", "summary": "A team built CaseGuard, an autonomous AI fraud investigator that combines TigerGraph, GSQL, GraphRAG and agentic reasoning to investigate suspicious transactions, gather extra evidence when confidence is low, recommend next-best actions and generate FinCEN SAR narratives. The system uses native GSQL queries for graph computation while an uncertainty gate defers to customer verification or step-up authentication instead of guessing, and closed cases are written back into the graph as institutional memory. Evaluated against all 20 official Hacker House Goa benchmark cases, CaseGuard reported 100% schema and policy compliance, correct fraud-typology identification and calibrated auto, L1 and L2 approval routing.", "body_md": "🚨 Introduction\n\nTraditional fraud systems often make a simple fraud vs. legitimate decision from static thresholds or risk scores.\n\nBut real fraud investigations are rarely that simple.\n\nA transaction can look suspicious because of a new device, unusual geography, or rapid small payments — while still being completely legitimate.\n\nThat is why we built CaseGuard: an autonomous AI fraud investigator designed to know what it doesn't know.\n\nCaseGuard combines TigerGraph, GSQL, GraphRAG, and agentic reasoning to investigate suspicious transactions, gather additional evidence when confidence is low, recommend the next-best action, generate SAR narratives, and remember previous cases.\n\n🏗️ Architecture\n\nThe CaseGuard workflow is:\n\nAlert → TigerGraph Analysis → Fraud Pattern Detection → GraphRAG Policy Grounding → Uncertainty Gate → Evidence Gathering → Next-Best Action → SAR Generation → Case Memory\n\nTigerGraph acts as the cognitive spine of the system.\n\nOur graph contains entities such as:\n\nCustomer\n\nCard\n\nTransaction\n\nDeviceProfile\n\nBillingRegion\n\nClosedCase\n\nInvestigationCase\n\nThese entities are connected through relationships such as OWNS, MADE, FROM_DEVICE, BILLED_IN, and INVOLVES.\n\n⚡ How We Used TigerGraph\n\nInstead of asking an LLM to perform complex graph calculations, CaseGuard uses native GSQL queries.\n\nThe card_window query analyzes transaction windows to detect rapid micro-authorizations followed by larger spending.\n\nThe device_neighbors query expands through shared devices to discover connections between multiple accounts.\n\nIn benchmark case HHG-014, the graph revealed one Android device connected to 52 customer cards.\n\nThe region_burst query compares transaction geography against a customer's historical behavior to identify suspicious out-of-region activity.\n\n🧠 Uncertainty-Gated AI\n\nOne of our main ideas is simple:\n\nIf the system isn't confident, it shouldn't guess.\n\nFor example, if an alert is based only on a moderate risk score, CaseGuard does not immediately block the customer.\n\nInstead, it follows policy and requests additional evidence, such as:\n\nCustomer verification\n\nStep-up authentication\n\nTransaction confirmation\n\nThis creates a safer investigation workflow instead of relying on a single signal.\n\n🔄 Next-Best Action\n\nCaseGuard generates recommendations at two stages.\n\nBefore Evidence\n\nThe system may recommend:\n\nALLOW + VERIFY_WITH_CUSTOMER\n\nor\n\nDECLINE + STEP_UP_AUTH\n\nAfter Evidence\n\nIf evidence confirms fraud, the recommendation can evolve into actions such as:\n\nBLOCK_CARD\n\nCREATE_CASE\n\nFILE_REPORT\n\nwith appropriate approval routing such as auto, L1, or L2.\n\n🧠 TigerGraph Case Memory\n\nCaseGuard doesn't forget completed investigations.\n\nEvery closed case is stored back into TigerGraph using the insert_case_vertex query.\n\nFor example, when HHG-012 generated an out-of-region alert, CaseGuard retrieved a previous case containing legitimate travel history for the same cardholder and used that information to clear the alert.\n\nThis turns previous investigations into institutional memory.\n\n📄 Automated SAR Generation\n\nWhen a case meets the required reporting conditions, CaseGuard can generate a structured FinCEN Suspicious Activity Report (SAR) narrative.\n\nThis helps investigators move from detection to documentation without manually reconstructing the entire investigation.\n\n📊 Results\n\nWe evaluated CaseGuard against all 20 official Hacker House Goa benchmark cases.\n\nOur documented results included:\n\n✅ 100% schema and policy compliance\n\n✅ Correct identification of multiple fraud typologies\n\n✅ Calibrated auto, L1, and L2 approval routing\n\n✅ Case-memory retrieval for previous investigations\n\n💡 What We Learned\n\nThe biggest lesson was the importance of separating graph computation from LLM reasoning.\n\nTigerGraph handles the deterministic relationship and graph analysis, while the AI layer focuses on interpreting structured evidence and making policy-grounded decisions.\n\nWe also found that storing investigation outcomes directly in the graph provides useful entity-level memory for future investigations.\n\n🚀 Future Improvements\n\nWith more development time, we would add:\n\nReal-time streaming using Kafka/Redpanda.\n\nCommunity detection using graph algorithms such as Louvain or WCC.\n\nInteractive analyst co-pilot with conversational investigation capabilities.\n\n🏁 Conclusion\n\nCaseGuard demonstrates how TigerGraph + GSQL + GraphRAG + Agentic AI can work together to create a more explainable and evidence-driven fraud investigation workflow.\n\nInstead of simply asking:\n\n\"Is this transaction fraud?\"\n\nCaseGuard asks:\n\n\"What evidence do we have, what don't we know, and what should we do next?\"\n\nThat's the idea behind CaseGuard — an investigator that knows what it doesn't know. 🕵️♀️⚡", "url": "https://wpnews.pro/news/caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on", "canonical_source": "https://dev.to/sanskreetimeshram/caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on-tigergraph-3j7g", "published_at": "2026-09-24 13:58:17+00:00", "updated_at": "2026-09-24 14:32:45.235110+00:00", "lang": "en", "topics": ["ai-agents", "artificial-intelligence", "ai-tools"], "entities": ["CaseGuard", "TigerGraph", "GSQL", "GraphRAG", "FinCEN", "Hacker House Goa"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on", "markdown": "https://wpnews.pro/news/caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on.md", "text": "https://wpnews.pro/news/caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on.txt", "jsonld": "https://wpnews.pro/news/caseguard-winning-with-uncertainty-gated-agentic-fraud-investigation-on.jsonld"}}