Six acts stay with the fraud analyst at every depth: concluding that fraud happened, unblocking an account on the customer's word alone, filing or withdrawing a suspicious transaction report, contacting a suspect outside an approved script, changing detection rules, and altering the case record. Each one either removes the human check or carries accountability that belongs to a named person.
Why do some fraud decisions never move to the agent?
Most limits on a fraud agent are "not yet". It drafts today and may release low-value holds later, once it has proven that capability on the firm's own cases. Depth rises with evidence.
A red line is different. Good performance does not move it, because the problem is not accuracy. Some acts would let the agent mark its own homework. Others carry legal consequences for a person, such as a report to the authorities or a decision that a customer committed fraud. A fraud analyst who knows which is which can let the agent work hard everywhere else.
What are the red lines?
| Never let the agent | Why it stays with a person |
|---|---|
| Conclude that a customer or merchant committed fraud | The conclusion can close accounts, end relationships and follow a person; it needs a named judgement |
| Unblock an account or card on the customer's declared statement alone | Fraudsters impersonate customers; "it was me" is the message they send |
| File, amend or withdraw a suspicious transaction report | Reporting is the accountable act of a named person under AML rules |
| Tell a suspect, directly or by implication, that they are under investigation | Tipping off can be an offence and ruins the case |
| Change its own detection thresholds or rules | The bounds would stop being bounds |
| Edit or delete entries in the case record | Nothing could be reconstructed for a dispute or an audit |
A card fraud team might add its own items, such as "never whitelist a merchant" or "never release a hold on a card already reported stolen". KYC teams keep a parallel list, set out in what KYC analysts should never let an agent do.
How are the red lines enforced?
Not by telling the agent. A sentence in its brief saying "never unblock without checks" is a request, not a control. Enforcement sits outside the agent and runs at the moment of action.
Two mechanisms do the work. Items the firm chooses go into its own limits, and the agent's attempt produces a refused or held verdict naming that limit. A small set of actions is withheld at the platform floor for every agent at every depth, such as reversing a settled payment on the firm's own rail. The analyst should know which kind each red line is, because only the firm's own limits can be changed, and only through its own governance.
What does a red line look like in a live case?
Take an online retailer's fraud desk. An agent has blocked a card after three high-value orders to a new delivery address. The cardholder emails within minutes: "These were mine, please unblock, I'm travelling." The message arrives as an external claim, and the account holder has not authenticated.
The agent drafts a reply asking the customer to confirm through the app and holds the unblock for the analyst. The analyst sees the delivery address matches a pattern from two earlier cases, keeps the block, and adds a note explaining why. The agent's draft never became an action, and the record shows who decided and on what.
Teams in Canadian e-commerce face this pattern often; the role detail is in fraud analyst training in e-commerce in Canada.
How do analysts keep the red lines sharp?
Red lines erode through habit. An analyst who approves fifty held unblocks a day starts to skim. Three habits prevent this.
First, every decline carries a written reason, so the agent's next qualification round learns from it; see how to teach fraud analysts to bank corrections. Second, the team reviews a sample of approved items each week, looking for drift in its own judgement, not just the agent's. Third, the red line list is reread after every incident and every new fraud typology. The shared principles across roles are in AI agent skills by role.
Where the Academy fits
Red lines are built into how Pryme Intelligence Academy certifies operators. The practicum is two weeks of real review decisions, and a single missed red line fails it regardless of overall accuracy. Fraud analysts work through module tests set in their own industry and role, so the cases they practise on look like their queue.
Questions people ask
Can the agent ever release a fraud hold on its own?
Yes, for narrow patterns it has been certified on, at depth 3, within the firm's limits. That is routine work within bounds, which is different from concluding a case or overriding a customer's block.
Should the agent see suspicious transaction reports at all?
It can read prior reports at depth 1 if the firm permits it, and it may draft a narrative for the analyst. Filing stays with a person.
What if a red line slows the team down?
Measure the slowdown, then look for the routine work around it that the agent can take on. The red line itself stays.