Streamlining RiskOps with the SOP agent framework

Summary

Risk Operations teams investigating Account Takeover (ATO) cases must gather data across systems, run SQL queries, and make decisions under pressure, creating delays and error risk. The SOP-driven LLM agent framework represents the workflow as a natural-language, indentation-based tree whose steps specify queries, external functions, and decision criteria. During execution, the SOP planner navigates the tree and produces JSON-formatted instructions, while a Worker Agent invokes APIs or SQL queries and stores results in a feedback loop. The process ends by synthesising investigation data into a report and final decision. In reported results, handling time fell from 22 to 3 minutes per ticket, 87% of ATO cases were automated since launch, and the error rate was zero.

Takeaways

1. 1

   SOPs use an intuitive indentation format, with @function_name notation marking external function or system integration points such as @IP_web_login_history.

2. 2

   The SOP planner and Worker Agent divide responsibilities: the planner navigates the investigation and selects calls, while the Worker Agent executes APIs or SQL queries and stores results.

3. 3

   Reported outcomes include a reduction in handling time from 22 to 3 minutes per ticket, automation of 87% of ATO cases since launch, and a zero-error rate.