How the parts fit

The model labels the intent. The code decides, acts and verifies. Select a part. Switch to the production view to see what replaces each mock.

The demo view shows what runs on the public link.

Parts

Select a part of the drawing or a button above.

Customer page

Real Code decides

Shows the chat and the list of charges. It calls POST /api/v1/chat. The bank sets the name and the accent color.

In the demo: A static page that the FastAPI process serves. It takes the brand from configuration.
In production: The same page, with the brand of the bank.

Evidence: docs/build/decisions/006-frontend.md · sentinel-ai-core/app/static

Login and session

Mock Code decides

Proves who the customer is. Each tool call is bound to this session. The model never sees the customer id.

In the demo: Test users with a fixed test login. They prove the session design, not a real identity check.
In production: The identity provider of the bank.

Evidence: docs/architecture/mocks.md · sentinel-ai-core/app/session

Data masking

Real Code decides

Masks personal identifiers in the customer text before any model call.

In the demo: The production code in app/privacy.
In production: The same code.

Evidence: docs/build/decisions/004-pii-lifecycle.md · sentinel-ai-core/app/privacy

Orchestrator + router

Real Model labels

A prompted LLM labels the intent. It decides nothing else. A keyword baseline answers a turn when the model fails.

In the demo: GLM 5.3 Flash on Fireworks AI with live calls. The keyword baseline is the per-turn fallback.
In production: The same weights on Azure AI Foundry or Databricks.

Simulation 81.8% of 308 intent accuracy of the LLM router. evidence/evaluation-runs/2024Q4-eval-v8/summary.json · candidates.router_v2.intent.accuracy

Simulation 69.2% of 308 intent accuracy of the keyword baseline. evidence/evaluation-runs/2024Q4-eval-v8/summary.json · candidates.baseline.intent.accuracy

Evidence: docs/build/decisions/016-router-models.md · evidence/evaluation-runs/2024Q4-eval-v8/summary.json · sentinel-ai-core/app/ai

Turn records and logs

Real Code decides

Writes one record for each turn, chained so that a change shows.

In the demo: JSON lines to Log Analytics on the public link.
In production: The same records.

Evidence: sentinel-ai-core/app/observability

Policy engine

Real Code decides

Allows, refuses or hands off. It returns a rule id for each decision. A request to explain gets the stored decision.

In the demo: The production code. The rule values (window, fraud and amount thresholds) are team-written and labelled synthetic.
In production: The same code with the policy that the bank approves.

Test suite 0/42 attacks with an unsafe outcome. evidence/adversarial/20261005T014816Z/summary.json · totals.unsafe_outcome_rate

Test suite 38 of 42 blocked by production code. evidence/adversarial/20261005T014816Z/summary.json · totals.blocked_verified

Evidence: docs/build/decisions/021-dispute-policy-sources.md · evidence/adversarial/20261005T014816Z/summary.json · sentinel-ai-core/app/policy

Confirm + read-back

Real Code decides

Asks the customer to confirm the charge. After the action, it reads the case back from the store and says so only when the case exists.

In the demo: The production code.
In production: The same code.

Evidence: docs/architecture/specification.md · sentinel-ai-core/app/orchestrator

Session-bound tools

Real Code decides

Reads charges and opens a dispute for the session account only. No tool takes a customer id from the model.

In the demo: The production code. It reads the Gold mock on the public link.
In production: The same code, on the real Gold.

Evidence: sentinel-ai-core/app/tools

Advisor view

Mock Person decides

Shows the handoff package: the request, the verified facts, the actions that the system tried and the trace of each step.

In the demo: A demo advisor user with a read-only ticket view.
In production: A human advisor. Tickets go to the bank CRM through a queue.

Evidence: docs/build/decisions/015-handoff-delivery.md · docs/architecture/mocks.md

Case store

Mock Code decides

Keeps sessions, conversation state, dispute cases and handoff tickets. A restart keeps them.

In the demo: SQLite, with the same models. It records the case. No bank system receives it.
In production: PostgreSQL, and the dispute system of the bank.

Evidence: docs/architecture/mocks.md · sentinel-ai-core/app/models/dispute_case.py

Gold store

Mock Code decides

Holds the charges of each customer, without personal identifiers.

In the demo: On the public link, a labelled in-memory store. On a local run, the PII-free DuckDB view of synthetic data.
In production: Gold on Databricks.

Evidence: docs/architecture/mocks.md · docs/build/decisions/023-pii-gold-handling.md · sentinel-ai-core/app/tools/gold.py

Bronze, Silver, Gold

Real Code decides

Turns the raw tables into the PII-free Gold view.

In the demo: Real code run locally on DuckDB. The data is the synthetic dataset.
In production: The same package on Azure Databricks.

Evidence: sentinel-data-engine

Labels follow what is real and mocks. No number in this page is a production measurement. Static drawing (SVG).