Play 92
Telecom Fraud Shield
Real-time telecom fraud detection with sub-second blocking.
Real-time telecom fraud detection covering SIM swap attacks, international revenue share fraud, subscription fraud, Wangiri callbacks, and toll fraud with sub-second blocking and explainable alert generation. Event Hubs ingests CDR streams, Stream Analytics applies velocity rules, OpenAI generates explainable alerts, Cosmos DB stores fraud patterns and case history, and Functions execute automated blocking actions.
Architecture Pattern
Fraud detection pipeline: CDR stream ingestion - velocity rule engine - pattern matching - explainable alert generation - automated blocking
Azure Services
DevKit (.github Agentic OS)
- agent.md — root orchestrator with builder→reviewer→tuner handoffs
- 3 agents — Fraud Builder (gpt-4o), Reviewer (gpt-4o-mini), Tuner (gpt-4o-mini)
- 3 skills — deploy (216 lines), evaluate (112 lines), tune (263 lines)
- 4 prompts — /deploy, /test, /review, /evaluate with agent routing
- .vscode/mcp.json — FrootAI MCP with OpenAI key input + envFile
TuneKit (AI Config)
- config/openai.json - fraud analysis and alert generation prompts
- config/fraud.json - detection windows, score thresholds, velocity limits
- config/guardrails.json - false positive budgets, blocking SLA
- evaluation/eval.py - Detection rate >99%, False positive <1%
Tuning Parameters
Machine evidence
FrootAI evidence lifecycle
This is an internal evidence maturity label, not third-party certification, accreditation, legal compliance, or a production guarantee. Missing or expired evidence demotes automatically; catalog claims cannot promote a play.
This play currently has design evidence only. A runnable scenario, endpoint evaluation, and build receipts are the next contiguous gates.
Repo Intelligence
v1A no-clone, revision-pinned map for agents and humans. Observed evidence is separated from inferred flow so the output stays useful without pretending to be a full call graph.