Someone is working against you.
Laundering, takeover, intrusion. It adapts once caught.
01 · Signal
The evidence is already in your data. The detector isn't.
Ledgers, logs and sensors record everything. Turning "catch this" into a working detector still takes months, and most alerts are noise.
Something broke.
A bad job, a failing pump, a retry loop.
The data is lying.
A schema change makes normal look strange.
02 · Intent
Say what you're looking for. In plain language.
Start from a sentence or a policy. Lucir takes it from there.
New detectorFeasible
Flag accounts that take in many small transfers from new counterparties and move most of it out within a day.
- Understood your data
- Confirmed there is enough to learn from
- Building your detector
Illustration of the build flow.
03 · Build
The agent does the data work. You keep the judgement.
Your team gets a detector to review and approve, not a black box.
04 · Proof
Nothing goes live on a promise. It goes live on evidence.
Every detector the agent builds must clear its checks before anyone can deploy it. Then it is scored on history it never saw.
- Accuracy
- Flag rate
- Intent check
- Leak protection
05 · Watch
It keeps watch. Every alert traces back.
Once you approve it, it runs against your data around the clock, on the cadence you set. Its logic is frozen, and every retrained model is versioned.
Detector
Rapid pass-through accounts
detector 9f2c41d7…a41e approved
Recent runsalerts per run
Illustration of a monitored detector.