TNG RiskOps Agent

Account takeover operations workspace

21 active investigationsSeeded environment

seed demo-core-v2Seeded demo. Analyst override stays available.

Rules workspace

All rules live in one table. Expand a row to inspect it. Open builder to edit or add a rule in a popup instead of touching TypeScript.

ACTIVEReplay synced

Freeze on severe ATO sequence

Use severe action only when device, credential reset, and movement risk appear in the same session.

Last draft expression

FREEZE_ACCOUNT if :is_new_device = true and :pin_reset_24h = true and :amount_ratio_30d >= 5

Bad caught

Good delayed

Reviews

This is the actual control surface. Expand a row for the logic. Open builder to edit or create a rule.

	Rule	Status	Action	Threshold	Version
	Freeze on severe ATO sequence RULE-ATO-FREEZE-001 \| Transfer-enabled wallets	ACTIVE	Freeze Account	85	v12
Rationale Use severe action only when device, credential reset, and movement risk appear in the same session. Rule expression FREEZE_ACCOUNT if :is_new_device = true and :pin_reset_24h = true and :amount_ratio_30d >= 5 Conditions :is_new_device=true First-seen device within the last 24 hours. :pin_reset_24h=true Credential reset happened in the active risk window. :amount_ratio_30d>=5 Current transfer is at least 5x the 30-day average.
	Step up dormant wallet recovery RULE-ATO-STEPUP-009 \| Dormant wallets	ACTIVE	Step Up Verification	82	v6
	Escalate likely post-loss case RULE-UTX-ESCALATE-003 \| Unauthorized transaction review	SHADOW	Escalate	78	v3

Same seed, deterministic result, visible tradeoff. Replay only changes when the user presses replay.

Scenario	Before	After	Impact
Primary ATO case	Step Up Verification	Freeze Account	One extra bad case stopped before transfer completion.
Dormant wallet recovery	Allow	Allow	One extra good user delay introduced.
Unauthorized transaction backup case	Review	Review	Analyst workload rises but evidence pack is more complete.

This is the allowed field catalog. The builder and AI draft flow both clamp to this list.

Variable	Type	Lookback	Source	Transform
:is_new_device True when the current device is first seen within the last 24 hours.	BOOLEAN	24h	behavior_events.device_first_seen_at	device_age_hours <= 24
:pin_reset_24h True when the user reset PIN within the last 24 hours.	BOOLEAN	24h	account_changes.pin_reset_at	pin_reset_at >= now - 24h
:amount_ratio_30d Current transfer amount divided by the user's 30-day average.	RATIO	30d	transactions.amount, transactions.avg_30d	amount / avg_30d