Built for the All Things Agentic Hackathon Track · Fortified Enterprise Fleet

INTERDICT

When Treasury moves, the money stops itself.

A three-agent sanctions-interdiction fleet that re-screens an entire counterparty book every time OFAC publishes — unattended, and graded against sources we do not control.

$
0.995 vs 0.840 · top-1 against the independent oracle
59 held · $1,181,434.51 frozen · 0 quarantined
364 tests · p50 9.34 ms · a 400-name pass in 7.6 s
OFAC SDN · 08/07/2026 · 19,199 records
Gemini 3.5 Flash Lite · Google GenAI SDK · Cloud Firestore · Postgres 16
The market failure · and the person standing in it
$30,000/yr
Where bank sanctions screening starts — and the vendors will not sell it to a 12-person NGO at any price.

Amara runs grants at a humanitarian NGO moving money toward three sanctioned regions. The same strict-liability statute binds her and JPMorgan: intent is irrelevant, headcount is irrelevant. The morning Treasury updates the SDN list, every queued disbursement — grantees, field partners, vendors — becomes her personal federal exposure.

A true hit must be held and reported within 10 business days. A delisting means blocked funds must be released. Today she does it by hand, late, or not at all.

GET sanctionslistservice.ofac.treas.gov/changes/latest → 200 · XML · ns treasury.gov/ofac/DeltaFile/1.0 datePublished 2026-08-07T00:00:00-04:00 publicationType Standard Action entities 26 action="add" 18 action="remove" 8 archived sha256 9403f40d9496…
A real OFAC publication, archived by content hash in data/archive/. Deltas land at any hour and carry explicit add / remove actions — each one changes what Amara may legally pay, in both directions.
02 · problem
strict liability · every US person · headcount is irrelevant
The solution · one flow, done to the bottom

The whole book, re-screened unattended.

DELTA LANDS → FULL-BOOK RE-SCREEN → HOLD | CLEAR → RELEASE ON DELISTING → 10-DAY REPORT
interdict · evidence console — one re-screen of the payment book
Interdict evidence console: the amber synthetic-payment-book banner, then seven cards reading 101 counterparties, 1 re-screen run, $1,181,434.51 money held, 59 held, 0 released or cleared, 0 quarantined, 59 adjudications, 0 guard disagreements

101 counterparties screened against all 19,199 records of the 08/07/2026 OFAC publication. 59 held, $1,181,434.51 frozen, 0 quarantined, 0 guard disagreements — and not one of those verdicts decided by a human.

The amber banner is in the product, not added for this deck. This run's ledger trigger reads MANUAL — a person typed the command; everything after it is unattended. Slide 09 says exactly how far that goes.
03 · solution
the agent is the product — the console is one evidence view
Architecture · three agents · two planes · one guard

Deterministic code decides what executes.

EXTERNAL · TREASURY OFAC SDN feed 19,199 records · 08/07/2026 /changes/latest · add | remove 6h poll · launchd archives every fetch by content hash · idempotent an unseen hash opens a run money plane idempotent holds · release on delisting 10-business-day blocking report orchestrator the only writer of decisions ORACLE GUARD · ON THE RETURN PATH CLEAR on a near-identical name → refused identifier not in the record → refused rationale too thin to file → refused MAX_ROUND_TRIPS = 2 → quarantine decision + outbox in one transaction fails closed — quarantined money stays held PLANE 1 · NO MODEL matcher Jaro-Winkler · token coverage OFAC weak-alias downweighting date-of-birth contradiction PLANE 2 · THE ONLY MODEL CALL adjudicator gemini-3.5-flash-lite · GenAI SDK response_schema · temperature 0 verdict · cited_fields[] · rationale screen() adjudicate() NOT OURS yente OpenSanctions scope: us_ofac_sdn never gates a decision consulted on every verdict Postgres 16 append-only hash-chained ledger · idempotent holds · outbox · quarantine
Three agents, one process. The separation is enforced by the Adjudicator protocol and the guard, not by a network hop — calling this a fleet of microservices would be a nicer diagram and a false one.
04 · architecture
Gemini explains and judges — deterministic code decides what executes
The number · measured on names that are NOT on the list
INTERDICT — top-1, n = 400
0.995
yente / OpenSanctions — the independent oracle
0.840

Why not the 1.000 we could have shown you

Screening the seeded book verbatim scores 1.000 and means nothing — those names were copied out of the very publication being searched. So the reported number screens 400 deterministic perturbations: transliterations from OFAC's own alias lists, reordering, dropped particles, confusables. Seeded from SHA-256, so the set is byte-identical on your machine.

The tail below prints yente at 0.843 — the same measurement re-run against a live index on a different day. data/g1-perturbed.json records 0.840, and 0.840 is what we quote.
make challenge-set — verbatim stdout, tail
Verbatim output of make challenge-set: recall 1.000, top-1 0.995, agreement with yente 0.835, yente's own recall 0.843 marked as the bar to clear, scored at or above T_HI 0.978, latency p50 10.0 ms p95 73.7 ms, both rows where the true uid was not ranked first named in full, and G1 verdict PROCEED
05 · the number
make challenge-set re-derives this on your machine
Decision quality · graded against a column the screening path never reads

1 missed hit in 60. 0 frozen grantees in 41.

populationexpectedcorrectreached the model
sentinelon the list, exact namesHOLD30 / 3030
variantsame person, different transliterationHOLD29 / 3029
lookalikedifferent person, shared surname, contradicting DOBCLEAR25 / 250
ordinaryunrelated granteesCLEAR16 / 160
Not one CLEAR-expected counterparty reached the model. All 59 adjudications came back HOLD, because a contradicting date of birth cuts a lookalike below the bar first. So this table grades the matcher on clears and the model on holds.
0
times we cleared someone the independent oracle flagged
Across the same 59 adjudications: 58 where both flagged a hit, 1 where we held and yente missed, 0 the other way. Under strict liability the dangerous direction is being more permissive than the oracle. We never are.
console · adjudications — one row, unretouched
One row of the adjudications table in the Interdict console: id 59, AL AZZAWI HIKMAT MISBAN IBRAHIM, uid 7870, score 0.9283, verdict HOLD, guard AGREE, yente HIT 7870 0.900
06 · graded
101-counterparty stratified sample — free-tier Gemini caps requests per model per project per day
Autonomy, graded · no self-grading anywhere

Four decisions, four external graders.

HOLD money stops
An adjudicated true hit parks the counterparty and every queued disbursement — idempotent by database constraint, so a re-screen cannot double-hold.
The SDN record on treasury.gov — name, DOB, passport. make challenge reproduces it for any name you type.
CLEAR payment proceeds
The disbursement proceeds with the reason on record — the signal breakdown that ended it, using the 4,393 OFAC-flagged weak aliases in the 08/07/2026 publication.
OpenSanctions yente, scope-pinned to us_ofac_sdn and consulted on every adjudication, not only where it agrees. An oracle consulted selectively is not an oracle.
RELEASEmoney moves again
A delisting retires the hold and the money moves again, without anyone noticing the delta first.
Treasury's own published delta (/changes/latest) and the Federal Register notice. Today this leg runs as a labelled REPLAY of the real 2026-08-07 removals — it says REPLAY on every screen and is never implied live.
REPORTstatutory artifact
Drafts the blocking report against the real 10-business-day clock and files it to the append-only ledger.
The federal calendar, 5 U.S.C. 6103, and the public SDN record. Transmission to OFAC stays human — we draft and file, we do not submit.
07 · decisions
each decision executes without a human click — and each is graded by something we do not control
Fortified · what the track actually asks: what happens when a worker lies, loops, or dies

A confused agent cannot move money.

The guard does not trust the answer

“The counterparty name AL AZZAWI HIKMAT MISBAN IBRAHIM closely matches the primary name Hikmat Mizban Ibrahim AL-AZZAWI on the SDN record, with full to…” gemini-3.5-flash-lite · adjudication 59 · uid 7870 · 0.9283 · HOLD · guard AGREE · yente HIT 7870 0.900 · 1 round trip
Every cited identifier is checked against the record — a fabricated alias in a federal blocking report is the worst output this system could produce. Also refused: a CLEAR on a near-identical name with no contradicting evidence, a HOLD below the no-hit floor, a rationale too thin to file. On refusal it asks once more with the disagreement stated, then stops. The cap is two round trips — in code, and again as a database CHECK.

“Wrong” and “did not answer” are different failures

They were the same failure here until the first real Gemini run quarantined 438 of 536 counterparties — not one of them a bad verdict. The free tier allows five requests a minute; everything after the twenty-first returned 429 RESOURCE_EXHAUSTED into a bare except. Quarantine is where a human is told the system could not safely decide; burying that one case in 438 destroys it.
  • PARSE_ERROR — the verdict cannot be trusted. No retry; a human reads it
  • ADJUDICATOR_UNAVAILABLE — the verdict was never produced. 5 attempts, honouring the server's own retry in Ns
  • Money moves in neither case. The difference is what the operator is told
make test — verbatim stdout, the six worth watching
Verbatim pytest output: 134 items collected, six named tests all PASSED — ledger chain does not fork under concurrent writers, OFAC schema typo is pinned, weak alias count is as published, killed worker leaves the run open, no counterparty is skipped across a crash, checkpoints survive a process death
08 · fortified
364 tests · p50 9.34 ms · p95 68.82 ms · a 400-counterparty pass in 7.6 s
Provenance · stated plainly, because a screening demo that blurs this is worthless

Sealed before Treasury moved.

make verify-book — verbatim stdout
Verbatim output of make verify-book: OK book matches its seal 66eb151cc7473024ed3f9fb4f43700edde828a5ab53d7122e6145c58e72b9b1b, publication 08/07/2026 with 19,199 records, snapshot ac00228a6834, and OK re-derived byte-for-byte from the sealed snapshot

The book is 400 names that were on the SDN list at seal time, chosen by the SHA-256 of each entry's uid — no RNG, byte-for-byte reproducible. It and its hash were committed on 2026-08-13, before any later OFAC publication existed. If Treasury delists one of them, git log proves the book predates the removal. As of 08/20, none has.

  • Treasury's data is unmodified. Every figure here is pinned to the 08/07/2026 publication — the live list is 19,249 records as of 08/20
  • The payment book is ours and synthetic, labelled by origin in the database, on every console screen, and on camera
  • The RELEASE leg is a labelled REPLAY of the real Aug-7 removals. It says REPLAY on screen and is never implied live
  • The graded run's ledger trigger reads MANUAL — a person typed the command. The chaining timer is armed in the plist and has not yet fired a re-screen
  • The 6-hourly poll was dead 08-17 to 08-22. A lint pass modernised timezone.utc under a Python 3.9 launchd invocation. Disclosed because “unattended” is a claim this project makes
  • Nothing runs on Google Cloud compute. Cloud Firestore's free tier holds the mirrored ledger; the agents, Postgres and yente are local
09 · provenance
disclosure plus a reproduction path is the design, not the apology
The ask

Grade us against Treasury.

$ make challenge NAME='any name you type' # screened against the real list, with the signal breakdown # and yente's independent opinion beside it $ make reproduce # installs · brings the stack up · indexes the oracle # runs 364 tests · re-derives the 0.995
  • Cross-check any HOLD on treasury.gov — name, DOB, passport
  • Cross-check the RELEASE against OFAC Recent Actions, Federal Register 2026-16153, and the OpenSanctions mirror
  • Verify the sentinel book's git timestamp predates every later OFAC delta
QR code linking to github.com/edycutjong/interdict
github.com
/edycutjong
/interdict
solo build · edy.cu@live.com
Fortified Enterprise Fleet
All Things Agentic Hackathon
If anything were staged, the git history would convict us.
10 · ask
interdict
01 / 10
← → navigate · ESC overview · P presenter · C contrast
Speaker notes