AI for detection: Rule recommendations
Part of a two-post series on Unit21's Detection Agents. This post covers Rule Recommendations. Read part two on Rule Writer Agent for the other half of the story: building new rules from plain language instead of tuning existing ones.
Rule Recommendations now backtests its own fixes: introducing Optimization Agent
You can now find out which of your rules need tuning, and see the fix already tested against your own alert history, before you spend an hour on it.
Optimization Agent is live today, the newest capability under Rule Recommendations, working alongside the existing Insights Agent. Together, they cover the two things every compliance and fraud team eventually has to do with a live rule set: figure out what's wrong, and fix it without guessing.
Why AML rule tuning never gets done
Rule tuning is one of those tasks everyone agrees matters and almost no one has time for. Tuning a single rule properly means exporting alerts, reading through narratives one by one, and manually reasoning about which cases are true positives and which are noise, then testing a change against history before trusting it. That's hours of work per rule, and most teams are running dozens of live rules at once. The realistic outcome is that rules get set once, at onboarding or when a new pattern first shows up, and then sit untouched for months or years.
A rule that hasn't been touched in three years is rarely a good rule. It's usually broad ("flag everything over $10,000") because no one had the data or the time to sharpen it, and it's usually generating a false positive rate that wastes analyst hours every single day. That's the exact pain point Rule Recommendations was built to close, and it's often the fastest way to tell whether a team is actually struggling with their existing detection setup, well before you get into feature comparisons or roadmap conversations.
Two agents, two different jobs
Rule Recommendations isn't a single tool, it's two purpose-built agents that work from different kinds of evidence and answer different questions.
Insights Agent is the qualitative layer. It reads a small sample of alerts, as few as one, but ideally around 10 true positives and 10 false positives, and pulls in everything text-based: the narrative notes an analyst wrote, plus the entity and transaction history behind the flagged alerts. It feeds that into an LLM and asks it to do the analysis a BSA manager would otherwise do by hand: export a batch of alerts, read every narrative, and look for a pattern worth turning into a rule adjustment. Insights Agent does the same review in about five minutes, and it surfaces the kind of qualitative pattern a purely statistical method or a traditional ML model would never see, because that pattern only exists in unstructured text. It's a strong starting point for any team, especially one that doesn't yet have much structured alert data to work with.
Optimization Agent is the quantitative layer, and it's the new piece. Rather than surfacing a direction, it proposes a specific, tested change and shows its work. It pulls a sample of up to 100 true positives and 100 false positives from the trailing 365 days of alert history on a given rule, and uses that sample to find the signal: what actually distinguishes a true positive from a false positive for this rule, on this data. From there, it tries the least invasive fix first, raising the rule's threshold, and checks whether that alone can cut false positives without giving up true positive coverage. If a simple threshold change isn't enough, it goes further and rebuilds the rule's logic around the signal it found: a tightened variable, a new exclusion, a more targeted population split. Whatever it proposes, it backtests immediately against the same historical sample, so what you see isn't a hypothesis, it's a rule with results already attached.
Nothing here deploys automatically. Every recommendation is a proposal for a human to review, adjust if needed, and approve, with the evidence already assembled instead of buried in a spreadsheet.
What a recommendation actually looks like
Take a card-purchase rule flagging anything over $3,000 in a rolling week, a common shape for a rule that's aged past its usefulness. Over time it's built up a false positive rate north of 75%, and most of that noise traces back to one predictable group: business accounts making routine, high-ticket purchases that were never suspicious in the first place. Optimization Agent finds that pattern in the alert history, proposes a targeted exclusion rather than a blanket threshold increase, and backtests it against the sample: the recommendation shows exactly how many past false positives the change would have removed, and confirms the real true positives in that same sample are still caught. An analyst reviewing that recommendation isn't starting from a blank page, they're approving or adjusting a specific, evidenced change, with the reasoning and the source alerts right there.
The guardrails, and why they matter more than the headline number
The number people ask about first is false positive reduction, and the honest range is 10 to 60% fewer false positives on a tuned rule, with true positive coverage typically holding around 85% or higher, tested against the rule's own historical sample. But the more important story, especially for a regulated business, is what the Optimization Agent refuses to do. It's built with guardrails first: it will never propose a change that would have dropped an entity with a filed SAR out of coverage in its sample. That's not a nice-to-have, it's the difference between a recommendation your team can actually trust and a black-box suggestion you have to take on faith.
This is also the cleanest way to differentiate against a competitor who claims to offer "rule tuning" or "rule recommendations" too. Ask what guardrails they've built in. Ask how they protect true positive coverage while cutting noise. Ask whether the numbers they show you are backtested against the customer's own data or a generic benchmark. Because Optimization Agent is built on top of Unit21's existing rules engine, augmented with AI and LLMs rather than replacing it with an opaque model, it gives you the tuning power people expect from machine learning with the explainability, auditability, and control that a rules-based system has always offered. Every recommendation still runs through your team's own validation and shadow testing before it goes live, the same rigor any change to a live rule requires in a regulated environment, and every number you see is scoped explicitly to the sample it was tested against, not a promise about performance outside that sample.
Eligibility and what's coming next
Optimization Agent currently works on entity- and transaction-based rules with enough labeled history to build a reliable sample, at minimum five true positives and five false positives with dispositions mapped, though it performs best with a larger sample and on rules with a meaningfully high false positive ratio to begin with. Instrument- and action-based rules are on the roadmap. Insights Agent has a lower bar: it can work from as little as a single alert, which makes it a good first step for teams that don't have much labeled data yet.
Why better rules make better recommendations
Rule tuning has always been the right thing to do and the first thing to fall off a busy compliance team's list, because doing it manually means hours of disposition review per rule, and most teams have dozens of live rules and no time to check them all regularly. That gap is exactly what turns into a stale rule set at exam time.
Rule Recommendations closes it by doing the analysis, not the judgment call. Your team still decides whether a recommendation fits your risk appetite, they just don't have to spend a day finding out whether it's worth considering in the first place.
There's also a flywheel effect worth knowing about if you're having a broader conversation about a customer's detection stack. Better rules, the kind you get from starting with Rule Writer Agent instead of a generic template, produce richer, more consistently labeled dispositions. Those dispositions are exactly what Insights Agent and Optimization Agent depend on to build a good sample. And a rule that gets tuned through Rule Recommendations is easy to hand right back to Rule Writer Agent for further edits, described in plain language rather than reverse-engineered field by field. The two capabilities feed each other, and the more of the loop a customer is using, the better each piece gets.
What's live today
Insights Agent has been live and flagging underperforming rules for a while now. Optimization Agent is the new piece: it's generally available today, running on top of the same rules and the same alert history Insights Agent already has visibility into. If you've used Rule Recommendations before, there's nothing new to set up, the backtested fix shows up wherever the flag already did.
How to use it
Open any live rule and go to the AI Recommendations tab. If Insights Agent has flagged the rule, you'll see Optimization Agent's proposed fix alongside it, with the backtest results, the rationale, and the specific alerts it's based on. Review, adjust if needed, and publish when you're ready.
If you're not sure where to start, the rules with the highest false positive rates or the most alert volume relative to their risk tier are the ones most likely to already have a recommendation waiting. Generating recommendations for a new rule can take up to an hour depending on data volume, so build that into your timeline if you're preparing this for a customer meeting or a demo.
See Optimization Agent on one of your rules
Bring a rule you already suspect is noisy and watch it get backtested live.
Gal Perelman is the Product Marketing Lead at Unit21, where she spearheads go-to-market strategies for AI-driven risk and compliance solutions. With over a decade of experience in the fintech and fraud sectors, she has led high-impact launches for products like Watchlist Screening and AI Rule Recommendations.
Previously, Gal held marketing leadership roles at Design Pickle, Sightfull, and Lusha. She holds a Master’s degree from American University and a Bachelor’s from UCLA, and is dedicated to helping banks and fintechs navigate complex regulatory landscapes through innovative technology.
