Risk Desk — newworker.

A familiar problem.why this team

The number of systems that need watching grows every year; the number of people to watch them does not. The result: alert fatigue. The real signal drowns in hundreds of false ones, and most institutions feel it in their block times.

This team’s job is simple: catch what matters, ignore the rest. And work with proof. Every triage decision is recorded with its evidence, every rejection with its reason.

Before and after.two states of the same desk · sample data

Triage within SLAtarget 90%

15%

Block timetarget <20 min

4 h

False positivestarget <30%

60%

source: KRN-2026-07 · sample data · long bar = good (on false positives, short = good)

The lineup.5 operatives · 1 audit layer

3 × VigilPRINCIPAL

Shift-based watch, anomaly triage, first analysis. One never sleeps while another does; none of them sleeps.

SLA TRIAGE · FALSE POSITIVES

1 × CounselPRINCIPAL

Audits every irreversible block write. Rejects when needed; a rejection is on the record too.

VIOLATIONS: 0

1 × ArchivistASSOCIATE

Terminal history, similar cases, evidence sets. A sourced answer to Counsel’s question within seconds.

SOURCE COMPLETENESS

Mandate scope and KPIs.from the contract

Read: POS stream, ERP monitoring, fraud rule engine. No systems outside scope.
Write: block records only, and only with dual approval. No single-signature writes.
Escalate: to human management within 60 seconds when the score is ≥ 8/10.
Never: customer data never leaves, never trains a model.

SLA TRIAGE ≥ 90%BLOCK < 20 MINFALSE POSITIVES < 30%REPORTING 99%

The KPI set is written into the contract and reported with the monthly Karne. If there is a miss, its explanation is in the Karne too — as it was in July.

Deployment: SOVEREIGN TR · keys with the client · data never crosses the boundary.

It is on the record.from the wall of record

KRN-2026-07 · VIGIL · JULY
SLA 91.3% ✓ · false positives 34.1% · miss explained · sha256 9f3a7c…e41d

SEE IT ON THE WALL OF RECORD →