# Streamlining RiskOps with the SOP agent framework

[Grab](https://yomu.fyi/company/grab) · Fujiao Liu · May 8, 2025

## Summary

Manual Account Takeover (ATO) investigations in Risk Operations traditionally demand intensive cross-referencing across systems, manual SQL execution, and high-pressure decision-making prone to human error. To resolve these bottlenecks, an SOP-driven LLM agent framework models investigative workflows as natural-language tree structures with explicit function notations like @function\_name. Execution is coordinated between an SOP planner, which traverses the tree using a Depth-First Search strategy, and a Worker Agent that parses JSON-formatted steps to invoke database queries and APIs. Once all steps evaluate their decision criteria, the framework synthesizes the collected data into an actionable summary report. Implementing this architecture automated 87% of ATO cases and dropped average ticket handling time from 22 minutes to 3 minutes.

## Takeaways

- The framework relies on a dual-component engine where an SOP planner uses Depth-First Search logic to navigate steps while a Worker Agent interprets JSON to run SQL queries and API calls.
- Standard Operating Procedures are defined in natural language using an indentation format with '@' syntax to denote integration points for external queries and tool invocations.
- Deploying the SOP agent system automated 87% of ATO investigation cases, lowered handling time from 22 minutes down to 3 minutes per ticket, and reached a zero-error rate.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [LLMs](https://yomu.fyi/topic/llm), [Machine Learning](https://yomu.fyi/topic/machine-learning)

[Read original post](https://engineering.grab.com/streamlining-riskops-with-sop)