Layer 02 · agencies, chains, agentic widgets

Your best people,
encoded.

A bench of 105 agencies who already know the work — screening a subject, reading a ledger, mapping a network, drafting the report. They read the case, decide what to look up next, check their own answer and act within policy, handing a person only what policy reserves. Your experts add their own, in words — and chain them into procedures that run end to end, with approval wherever your authority matrix reserves the decision.

105 agency marks; the last 21, in blue, run on a schedule or on an event
84 you send to work21 that never wait to be asked
105
Agencies ship ready
12
Disciplines
17
Chains ready to run
21
Run on a schedule
Watch them work → Every agency, in detail
What you are hiring

Every agency carries its own remit — and its own limits.

The prompt is one field on a form. Everything around it is what makes an agency safe to run against a real case — and what makes its answer defensible three months later.

CONTEXT Subject profile Case file Graph · workspace ALLOW-LIST Graph tools Case-file tools 217 built-in · your MCP BOUNDARY Clearance Data boundary REASONING LOOP Plan Call a tool Read the result Decide again TYPED RESULT Schema, not prose Widgets, citations DECLARED EFFECTS Risk · flags Tasks · activity Entity properties IF RESERVED A person accepts TRACE Every hop, timed NOTHING REACHES THE GRAPH UNGOVERNED
  • 01
    PurposeWhat it is for, in plain language — the part people actually edit.
  • 02
    ContextsWhere it may run: on a subject, a case, an investigation or a workspace. It sees nothing else.
  • 03
    Tool allow-listGlob patterns over the graph, the case file, 217 built-in tools — 151 for investigation, 66 for your own systems — and any other MCP server. A tool that is not on the list cannot be called.
  • 04
    Reasoning loopNot one shot. It plans, calls a tool, reads the result and decides what to do next — bounded by a turn limit and a tool cap.
  • 05
    Output shapeA JSON schema or markdown. A typed result can be checked, charted and cited; free text cannot.
  • 06
    Declared effectsThe only things it may change: a risk score, a flag, a task, a timeline entry, an entity property. Declared in advance, applied after.
  • 07
    AutonomyFive autonomy levels, L0 to L4. You choose the level for each process and can change it at any time. At a propose-only level the agency writes nothing and leaves everything in the review queue.
The work

Retrieve, extract, reason, check, act — within your policy.

01RetrieveThe context it is cleared to see — and only that.
02ExtractRecords, documents, identifiers and the links between them.
03ReasonA tool loop: it decides what to look up next, and why.
04CheckValidators, registry and sanctions calls, and review agencies that audit the output.
05DraftA typed result, with the widgets and citations it carries.
06ReviewProposals where you reserve the decision: accept, reject or roll back.
The library · 84 agencies, twelve disciplines

A bench of specialists. Hired once. Never off shift.

Every one ships enabled on day one, runs on the contexts it belongs to, and is yours to edit, clone or switch off. Hover a name for what it does.

Cyber18
Indicator extractionDarknet market analysisDigital evidence reviewInfrastructure mappingPhishing & BEC analysisRansomware attributionMalware sample triageC2 infrastructure pivotATT&CK mappingIntrusion timelineCredential & breach exposureRansom payment tracingAttack-surface reviewThreat-actor profileProvider process for cyber recordsContainment & recovery adviceInsider-threat reviewFraud-site takedown pack
Financial7
Money flow analysisLaundering typologiesAsset tracing for forfeitureSAR-style narrativeProceeds estimateCrypto flow analysisAML transaction monitor
Risk7
Risk scoreCase risk assessmentOfficer safety assessmentFlight riskPattern of conductVictim/witness vulnerabilityKYC profile reviewer
Analysis8
Network analysisRole in the networkHidden linksCell structureCommand structureGraph gap analysisCompeting hypotheses (ACH)Timeline reconstruction
Case operations9
Evidence gap reviewNext leadsElements-of-offence matrixInterview planSearch operation planArrest operation planTask prioritiserDeconfliction checkOnboarding document checker
Enrichment7
Enrich subjectEnrich organisationEnrich locationPhone number intelligenceCrypto wallet enrichmentVehicle enrichmentProfile enrichment
Legal process6
Legal authority gapsAffidavit drafterSubpoena / production requestTitle III compliance reviewDisclosure (Brady/Giglio) reviewChain-of-custody audit
Reporting6
Case summaryExecutive brief302 narrative drafterProsecution memorandumOperational briefing outlineWeekly status report
OSINT5
OSINT sweepSanctions / PEP screenSocial footprintCorporate registry checkAdverse media
Communications4
Communications pattern analysisIntercept summaryCode-word interpretationDevice attribution
Triage4
Tip / lead triageData quality reviewClassification & handling reviewDuplicate subject resolver
Human intelligence3
Informant reliability assessmentWitness credibilityCooperator value assessment

Agencies marked namePS belong to the Public Safety pack — law-enforcement work, shipped off by default on risk-domain deployments.

System agencies · 21 on a schedule or an event

The shift that never ends.

These are not waiting to be asked. They sweep on a schedule — hourly, daily, weekly — or fire on an event: a case opened, a subject linked, evidence added, a workflow step, an alert on a live graph. What they find is de-duplicated into findings a person acknowledges or dismisses.

Review3
Agent output reviewerCase-file reviewerReport reviewer
Validity4
Entity validity checkerRelationship validity checkerSource reliability graderIngest consistency checker
Intelligence support6
Collection plannerHypothesis managerIndicator & warning agentPattern & link analystIntelligence product writerRFI responder
Analysis3
Live-graph sentinelDeconfliction agentData-quality steward
Triage1
Intake & triage agent
Risk1
Screening & watchlist agent
Case operations1
Deadline & SLA agent
Legal process1
Evidence integrity agent
Reporting1
Briefing agent
Chains · agencies in sequence

One agency is a specialist. A chain is a procedure.

A chain wires agencies, deterministic tool calls, conditions, parallel branches and human approval gates into one procedure that runs on a schedule or on an event — the way a unit works, written down. Seventeen ship ready — six for the financial-crime desk (screening, monitoring, triage, investigation, quality and the SAR narrative), four Level 1 chains with no model anywhere in them, profile enrichment across twelve sources at once, and six more for intake, due diligence, cyber incidents, networks and reporting; the Studio draws the rest from a sentence.

screen_sanctions→Subject enrichment→Customer risk review→level in [high, critical]?→Adverse media→Supervisor gate→SAR / STR drafter

Blue is an agency, violet a deterministic tool call, amber a person. A gate on a case raises a two-person approval — the run waits, and resumes the moment it is decided.

AGENTIC STUDIO · THE INVENTORY
The Agentic Studio inventory
Browse, build, publishYour agencies and chains, the team's, the system's, and the templates — in one wall.
AGENCY RUN · LIVE EXECUTION TRACE
Every run shows its workingContext, model calls, each tool call and what it wrote — on the server clock, kept with the result.
SYSTEM AGENCIES · FINDINGS
The system agencies dock with findings
Findings, not noiseDe-duplicated per agency and target, ranked, acknowledged or dismissed by a person.
Governed by construction

Agencies inside. Policy at every step. All recorded.

Governed by constructionWhen the process runs at a propose-only autonomy level, or a change needs a decision you reserve, it appears as a proposal on the canvas and in the review queue, and stays out of reports until accepted.
It cannot reach further than youClearance, case grants and the data boundary apply to the agency exactly as they apply to the person who ran it.
The model is your choiceAny provider, in the boundary you set — your premises, a government cloud, or a commercial endpoint you approve.
Every run is on the recordTools, tokens, duration and cost, with the full execution trace kept beside the result.

How the Studio fits the three layers →  ·  Every agency, with its tools and effects →