Sentinel sits beside your finance system and watches every money-moving action. It checks each one against a set of fraud rules, and weighs it against what's normal for that specific person — blocking what's dangerous, holding what's doubtful, and waving through the routine 90%. There is no black box: every flag traces back to a number you can explain to an auditor.
Each money-moving event takes the same route. The AI does the watching and the math; your team owns every decision that actually moves money or closes a case.
No rule matched, nothing out of character. The action proceeds silently — the routine ~90%.
Low-risk flag. An operator eyeballs it and confirms before it proceeds.
Higher risk. The action is held until a controller or CFO approves it.
Sanctions hit or clear fraud signal. The action is rejected outright and never executes.
Every payment, vendor bank-detail change, write-off, deposit, and payroll run is recorded first — permanently — before anything else happens. That record is the source of truth everything else is rebuilt from.
The event is run past every applicable rule, and weighed against the person's learned baseline. The strictest verdict wins — one careful "block" outranks a dozen "pass" votes.
When something fires, Sentinel raises an alert, captures a tamper-proof evidence package, and opens a case — all stamped into an audit trail that can be added to but never quietly rewritten.
An analyst triages the case, investigates with the evidence and an AI Companion at their side, and decides. Every move is role-gated and logged for the record.
The case closes one of three ways: dismissed (false positive), suppressed (a known-good pattern muted), or confirmed fraud → funds recovered. The evidence exports cleanly for regulators.
The golden rule: Sentinel watching an action can never crash or delay it — observation always fails open. The single exception is the block gate, which is deliberately allowed to fail safe-closed: if it can't decide, it holds the money rather than letting it move.
These are the hard, named checks (plus a statistical family that learns — see below). They map to the classic fraud playbook: who's acting, where the money goes, and whether the paperwork holds up.
The same actor who initiated something also approved it — or created a vendor and signed off its first payment, or approved a subordinate's inflated expense.
A vendor's bank details change just before a payment, the funds route to an account the invoice never named, or an email-compromise pattern lines up. The classic BEC.
The vendor or beneficiary matches a sanctions-list entry. The single CRITICAL rule — a hard block, no judgment call.
The same invoice surfaces again, or deposits and payments are kept just under the reporting threshold to stay invisible.
A write-off of a type the actor isn't authorized for, posted to a locked period — or one that's wildly outsized versus that person's own history.
Ghost employees on the payroll, lapping across customer accounts, cash voided long after collection, lone off-hours sessions on sensitive screens.
Initiated and approved the same item within 24h.
ApproveEmployee bank change within 72h of payroll.
ApproveVendor bank change with a payment due in 72h.
Block / Appr.New account collides with one already on file.
ApproveVendor or payee matches a sanctions list.
BlockCreated a vendor and approved its first payment.
ApproveDeposit lands >72h after its cash receipt.
ConfirmSame vendor / amount / ref paid again within 90 days.
ApproveLone after-hours session on sensitive screens >15 min.
ConfirmAmounts kept just under the ~$10k reporting threshold.
ConfirmManager approves a subordinate's outsized expense.
ApproveCash receipt voided >4h after collection.
ApproveFour or more payments to one payee within 24h.
ConfirmMoney sent to an account the invoice never named.
BlockAn adjustment of a type the actor can't post.
BlockA write posted to a closed accounting period.
ApproveVendor address matches an employee's (ghost-vendor).
ApproveAR write-off with no matching inventory adjustment.
ConfirmSentinel also connects the dots. When several base signals converge on the same vendor, actor, or payment, it escalates them into a single, higher-severity coordinated-scheme alert — instead of three loose flags a human has to assemble.
Two or more ghost-vendor signals land on the same vendor within 30 days — a bank-detail change, a self-approved first payment, and an address that matches an employee.
A vendor bank change and a payment-destination mismatch line up on the same payment chain — alongside banking-keyword language in the email trail.
The same actor trips the separation-of-duties rule three or more times within 90 days — the signature of collusive lapping across accounts.
A $5,000 write-off is routine for one clerk and alarming for another. So Sentinel never judges against a universal number. It judges each action against that individual's own track record.
Picture a very attentive new colleague. At first they know nothing, so they stay quiet. Over weeks they notice "Dana usually writes off small amounts, a couple times a week." Now if Dana suddenly writes off something ten times her usual size, they lean over and say "that's unlike Dana — worth a look." Not an accusation. A break from a pattern they personally learned.
It updates a little with every event, as it happens — not in a nightly batch. The same way a colleague's sense of "normal Dana" shifts each time they watch her work.
It will not accuse someone it barely knows — by design.
Past your personal 99th percentile — bigger than nearly everything you've ever done.
Many times further from your average than your typical bounce — robust to one-off freak values.
Each action looks innocent, but the trend is steadily climbing — a classic fraud signature.
It only fires when the lenses agree something is both genuinely high and out of character — and it pauses its drift detector during month-end close, when bulk corrections are expected. So every alert reduces to a sentence you can defend:
"This $9,400 write-off was past Dana's own 99th percentile and 6× her usual swing — across 140 of her prior write-offs."