The platform doesn't detect anomalies. It proves them.

{
  "trace_id": "018f9b2e-7c41-7a40-ae21-f9c2d2c43e1a",
  "envelope_version": "2026.06.01",
  "source": {
    "system": "epic.audit",
    "ledger_offset": 884213,
    "ledger_hash": "sha256:9af3…e21c"
  },
  "subject": {
    "patient_eid":  "eid:pat:7c1a…09",
    "provider_eid": "eid:prv:0044…b2",
    "device_eid":   "eid:dev:ws-42",
    "resolution_confidence": 0.97
  },
  "score": 78,
  "severity": "CRITICAL",
  "factors": {
    "temporal_overlap": { "weight": 40, "ratio": 0.71 },
    "access_spike":     { "weight": 28, "z": 4.3 },
    "off_hours":        { "weight": 10 }
  },
  "ml_overlay": { "model": "iforest-v3", "p_anomaly": 0.94 },
  "incident_id": "inc:2026-06-02:0007",
  "audit": {
    "prev_hash": "sha256:71d2…c0aa",
    "self_hash": "sha256:bb40…91ef",
    "merkle_root_ref": "anchor:2026-06-02T14:10:00Z"
  }
}

• Single contract across rules, ML, graph, UI, and audit chain.
• No phantom data: if it appears on screen, it has a trace_id and a hash.
• Versioned: every envelope carries the rule_version and envelope_version it was scored under.
• Forensic replay: reconstruct any historical decision from envelope + ledger byte + rule_version.
• Identity-keyed: downstream baselines, graph features, incident grouping all key on EIDs.
• Audit-self-contained: prev_hash + self_hash + merkle_root_ref let an independent verifier check integrity offline.

• Deterministic pass. Exact match on NPI, government-issued patient identifier, verified SSN hash.
• Probabilistic pass. Fellegi-Sunter scoring on name n-grams, DOB, address tokens, phone hash, device fingerprint.
• Active-learning loop. Borderline pairs (0.65 ≤ p < 0.92) surface to compliance reviewers; decisions retrain weights weekly.
• Provider / device parallel pipeline. Workstation MAC, browser fingerprint, badge swipe, shift schedule.

MATCH (p1:Provider)-[:BILLED]->(c1:Claim)
        -[:DERIVED_FROM]->(e:Encounter)
        <-[:DERIVED_FROM]-(c2:Claim)
        <-[:BILLED]-(p2:Provider)
WHERE p1.eid < p2.eid
  AND duration.between(c1.ts, c2.ts).seconds < 900
WITH p1, p2, count(DISTINCT e) AS overlap
WHERE overlap >= 12
RETURN p1.eid, p2.eid, overlap
ORDER BY overlap DESC

MATCH (w:Workstation)-[l1:LOGGED_IN]->(p1:Provider),
      (w)-[l2:LOGGED_IN]->(p2:Provider)
WHERE p1.eid <> p2.eid
  AND abs(duration.between(l1.ts, l2.ts).seconds) < 300
RETURN w.id, p1.eid, p2.eid, l1.ts, l2.ts

The graph is not a side database — it is the feature store for ML. For every (provider, 15-min window) we materialize:

• degree_patients_15m / _24h / _7d
• pagerank_in_billing_subgraph
• co_billing_jaccard_max
• shared_device_count_24h
• ring_membership_score — Louvain community detection on co-billing edges

Every prediction carries a graph-context vector an investigator can interrogate.

record_n = {
  payload:   <Risk Envelope, canonical JSON (RFC 8785)>
  prev_hash: SHA-256(record_{n-1}.self_hash)
  self_hash: SHA-256(payload || prev_hash)
  ts:        monotonic ingest timestamp
}

// every 5 minutes
merkle_root = Merkle(self_hash[ window_t ])
write_postgres(merkle_root, window_t)
mirror_s3_object_lock(merkle_root)     // WORM, 7-year
anchor_rfc3161(merkle_root)            // public TSA

Incident
  ├── incident_id          inc:2026-06-02:0007
  ├── status               OPEN | TRIAGED | INVESTIGATING
  │                        | CLOSED | ESCALATED
  ├── severity             max-decay over events
  ├── primary_entities[]   provider_eid · patient_eid
  │                        · device_eid
  ├── root_cause_event_id  earliest trace_id
  ├── contributing_events  [trace_ids w/ weights]
  ├── graph_context        subgraph snapshot
  ├── narrative            deterministic + LLM draft
  └── audit_chain_ref      Merkle root covering all
                           contributing events

• Entity affinity. Events sharing ≥ 1 EID within a 30-min sliding window.
• Graph affinity. Events on a connected subgraph within 2 hops.
• Pattern affinity. Same rule-version + factor signature within 6 hours.
• Risk decay. severity = max(event.score) · e^(-λ · age)
• Reopen window. Closed incidents reopen on matching events within 7 days.

• Authored in versioned YAML DSL
• Weighted factors compose envelope score
• Every rule version signed, ledger-anchored
• Regulator can read the rule and reproduce the result

• Isolation Forest (unsupervised baseline)
• XGBoost on labeled incidents
• GNN node-classification on co-billing graph
• Features from graph store, never raw events
• Model card + offline eval gate every deploy

final = clamp_0_100(
  rule_score
  + α · ml_lift(p_anomaly, rule_score)
  + β · graph_context_score
)

α = 0.30, β = 0.20
// per-tenant, ledger-anchored