Automated Fraud Investigation and Reporting system
AFIR is an LLM-driven pipeline for automated security-incident investigation. It understands a free-text incident description, generates and executes log-retrieval queries against one or more configured backends, correlates the retrieved evidence, detects anomalies, and produces a structured investigation report. The engine is domain-generic; domain knowledge (entity glossary, source catalog, investigation playbooks, and verdict rules) is supplied by a knowledge pack.
The verdict itself is not an LLM judgement: the pack's rulesets are evaluated deterministically in code, and the LLM's job is to understand the incident, shape the queries, and narrate what the rules found. Those rulesets are written in a compositional vocabulary — Boolean combination, aggregate-then-compare, ordering, and pack-declared textual equivalence — so a new fraud pattern is new YAML rather than new code; and they can be drafted by the LLM at authoring time, proposed as a validated, dry-run edit plan that a human approves before anything is written.