Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Sentinel is a graph-native fraud investigation agent built by Team GOA-T. It connects transaction and customer relationships with historical cases, applies deterministic fraud checks and policy rules, and uses an LLM to explain the evidence for an analyst. Its reported 20-case benchmark is a project result—not proof of production fraud-detection accuracy.
What Sentinel is designed to do
A risk score can flag a transaction without showing why it looks suspicious, what related accounts or devices may be involved, or whether a similar pattern has already been cleared. Sentinel is designed to assemble that context into an investigation: retrieve connected evidence, test it against fraud signals and policy, and prepare an explanation that an analyst can review.
The project authors describe its governing principle as: “Let the graph gather evidence, let deterministic code enforce policy, and let the LLM explain the result.” That division of labor is central to the design. Sentinel is an investigation workflow, not simply a chatbot over a database or a model that issues a fraud score.
How an investigation moves through the system
Team GOA-T describes eight main components. Together, they form a bounded investigation process: an alert or analyst escalation starts the work, the system gathers evidence, policy determines what actions are allowed, and the case record is updated.
#1 Best Overall
| Component | Role in the described system |
|---|---|
| TigerGraph Savanna Cloud and an MCP client | Provide graph storage and a controlled interface for investigation operations. |
| Hybrid GraphRAG memory | Retrieves relevant historical cases using both semantic similarity and graph relationships. |
| Eight deterministic fraud detectors | Check defined patterns, such as shared devices, card testing, or unusual transaction bursts. |
| Legitimacy checklist | Prompts the investigation to consider explanations that could make a suspicious-looking pattern legitimate. |
| Deterministic policy engine | Applies rules governing permitted actions and approval routing. |
| Dynamic next-best-action engine | Identifies a next step based on the evidence and applicable policy. |
| LLM synthesis | Explains evidence and patterns, and drafts case or regulatory narratives. |
| Interactive analyst web cockpit | Provides an interface for analysts to examine and work with investigations. |
The workflow can gather more evidence when uncertainty remains, then reassess whether additional retrieval could change the permitted action. The project describes stopping conditions that include configured fraud-probability thresholds when sufficient independent evidence exists, customer verification, authentication, or reaching a point where more graph traversal would not change the policy outcome. The thresholds are configuration examples from this project, not universal fraud rules.
Purpose-specific graph operations
Rather than asking the agent to construct arbitrary graph queries, the project exposes specific investigation tools through MCP. The described operations include finding a customer’s cards, retrieving card history, locating shared devices, checking prior cases, and writing a case. This gives the agent a narrower interface than unrestricted access to the graph schema.
Why the graph matters
Sentinel models relationships among customers, cards, transactions, devices, billing regions, email domains, and historical cases. A transaction can therefore be investigated in relation to connected entities rather than as an isolated row.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For example, an investigation can traverse from a transaction to its device, find other cards associated with that device, and then look for closed cases associated with those cards. That path may reveal a connection that a single-transaction view would miss. But a connection is a lead, not a verdict: the Sentinel authors explicitly caution that a shared device alone does not prove fraud. A device may be shared for legitimate reasons, so investigators need corroborating evidence and context.
How GraphRAG brings in historical cases
Sentinel combines two kinds of retrieval. Semantic search looks for past cases with similar meaning or patterns; graph search looks for cases connected through entities and relationships. The project’s relevance-fusion step gives graph-adjacent cases an additional priority boost of +0.15. This is a reported implementation choice, not a generally validated tuning recommendation.
The authors report using sentence-transformers/all-MiniLM-L6-v2 to create 384-dimensional embeddings for cases. They also index cases that were cleared, rather than treating historical fraud cases as the only useful precedent. In the project’s example, prior cleared cases helped put a recurring merchant dispute in a potentially legitimate context. That approach makes negative evidence available to the investigation; it does not establish that the historical case data is complete or representative.
Rank #3
Which fraud patterns the detectors check
Team GOA-T lists eight detector families:
- Recurring merchant behavior
- Card testing
- Shared devices
- New devices
- Out-of-region activity
- Card-not-present transaction bursts
- Account takeover signals
- Shared-region clusters
These checks are signals to interpret, not automatic proof of wrongdoing. A recurring subscription may be expected, travel may explain an out-of-region transaction, and multiple customers may legitimately use the same device or region. Sentinel’s legitimacy checklist and historical retrieval are intended to help weigh such alternatives alongside the suspicious indicators.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the LLM can—and cannot—decide
The design reserves action authority for deterministic code. The policy engine determines permitted actions and approval routing; the LLM is used to summarize evidence, explain patterns and triggered rules, and draft case or regulatory narratives. The project authors state that the LLM is not allowed to decide whether to block a card or which approval route to assign.
The described rules include verification when there is only a weak, isolated signal, escalation for uncertain cases with high exposure, and limits on broad card blocking. This separation can make the intended boundary between explanation and action easier to inspect. It does not, by itself, demonstrate that the rules are correct, that the implementation enforces them without failure, or that the system is suitable for a regulated production environment. Those questions require evidence beyond an architectural description.
Rank #4
What Team GOA-T reports—and what the benchmark establishes
In its project article, published September 25, 2026, Team GOA-T reports these data and system-scale figures:
- 590,742 IEEE-CIS/Vesta transactions used by the project.
- 5,565 closed historical cases, including approximately 900 cases classified as cleared.
- Approximately 1.45 million transaction vertices in the live TigerGraph graph.
For evaluation, the team reports a benchmark of 20 cases, with 20 of 20 validation passes and a 100% policy validation pass rate. It also reports approximately 1.2 seconds for a fast-path investigation in the benchmark environment. That timing is a project runtime measurement, not a service-level agreement.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The 20/20 result describes validation outcomes for those 20 benchmark cases. It does not establish general fraud-detection accuracy, performance on a bank’s live transaction traffic, or effectiveness across different populations and operating conditions. The authors themselves caution that the benchmark should not be interpreted as production fraud-detection performance. The figures are self-reported project results, not an independent audit or reproduced evaluation.
Best Value
What to take from the architecture
Sentinel’s distinctive idea is to combine relationship traversal, semantic and graph-based case retrieval, deterministic detectors, explicit policy rules, and LLM-generated explanations in one investigation loop. Its strongest architectural boundary is the stated separation between evidence and policy: the graph supplies context, code governs actions, and the LLM communicates the result.
That is a design description, not proof that the system is production-ready. The project article does not establish current service pricing or availability, data-protection controls, regulatory suitability, or whether the live cockpit remains available. For readers evaluating the approach, the key questions are whether the graph and case data are trustworthy, whether policy rules are validated and auditable, how legitimate evidence is handled, and whether evaluation extends beyond a small project benchmark.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
