Alert · reviewed · open

Agent Payout Agent (Harbor) moved money on rails outside its declared scope (ach, realtime vs ach).

Detector: agent_out_of_scope
Severity: high
Program: Harbor Marketplace Payouts (simulated)
Subject: entity enti_sim_harb_3ijt1t3u3xa
Transfer: —
Skoor at alert: 50 review
Hard signal: no
Policy: policy-v1
Opened: 2026-09-17 19:32Z
Closed: —
Decision clock: none · due — no clock
Escalated: —

Draft narrative

What happened. Detector agent_out_of_scope raised an alert on entity enti_sim_harb_3ijt1t3u3xa for program Harbor Marketplace Payouts (simulated): Agent Payout Agent (Harbor) moved money on rails outside its declared scope (ach, realtime vs ach).. What the evidence shows. Transaction Risk Skoor 50 (band review). Entity Payout Agent (Harbor): verification VERIFIED, PEP no, high risk no. What was checked. Program KRIs as of the latest snapshot: frozen_accounts ok, hold_aging_hours watch, overdraft_events watch, manual_review_rate ok, card_fraud_declines unmeasured, pep_flagged_entities watch, velocity_vs_declared ok, stale_screening_share ok, high_risk_entity_share watch, reserve_coverage_ratio ok, ach_overall_return_rate ok, verification_denial_rate ok, manual_review_aging_hours breach, ach_unauthorized_return_rate breach, sanctioned_country_transfers ok, ach_administrative_return_rate ok, counterparty_concentration_top1 ok. No prior dispositions on this entity or counterparty. What is recommended. Recommended: escalate. A person decides; this draft was assembled from the evidence without a model (model call failed).

Recommendation

escalate

Confidence

null (template, no model)

Model

none (template)

Drafted

2026-09-17 19:32Z

Rationale

Template draft: recommendation follows the band and the hard-signal rule only.

Evidence

{
  "n": 125,
  "band": "review",
  "actor": "agent",
  "scope": [
    "ach"
  ],
  "skoor": 50,
  "signals": [
    {
      "code": "entity.unauthorized_returns",
      "detail": "1 unauthorized return(s) against it",
      "weight": 30
    },
    {
      "code": "agent.out_of_scope",
      "detail": "activity on realtime outside declared scope ach",
      "weight": 20
    }
  ],
  "version": "ars-v1",
  "railsUsed": [
    "ach",
    "realtime"
  ],
  "confidence": 1,
  "routeReason": "detector not auto-closable"
}

Decision

Dispositions

No disposition yet.

Actions

Freeze, request to program, and suspend need a second, distinct approver. Clear hold, cancel, and pause execute on the requester's approval. Executed through the bank's own API with the tenant's sandbox key; a dry run when there is none.

No actions requested.