AI for detection: Rule writer agent
Part of a two-post series on Unit21's Detection Agents. This post covers Rule Writer Agent. Read part one on Rule Recommendations for the other half of the story: tuning the rules you already have instead of building new ones.
The rule you can describe is the rule you can build
Most fraud and AML rules start the same way: someone notices a pattern, describes it in a sentence to a colleague or an analyst, and then that sentence has to survive translation into fields, operators, and thresholds before it's actually a rule. That translation step is where good ideas stall, not because the pattern was wrong, but because writing the logic takes someone who knows the schema.
Rule Writer Agent removes that step. Describe the pattern in plain language, or another language entirely, and it builds the deployable rule underneath it: variables, thresholds, and trigger conditions included.
Why the first version wasn't enough
It's worth being upfront about where this capability started, because the gap it closes is real. The original version, a one-shot "text to rule" prompt, generated a rule the moment you clicked a button. The team pushed hard on reliability and eventually got the technical failure rate down to under 1-2%. But a rule that compiles cleanly isn't the same as a rule that does what you meant. The real problem wasn't failure to generate, it was misalignment: the rule that came back often didn't match the intent behind the prompt, and there was no way to go back and forth with it to fix that.
The new version, rolling out now, is built around a different idea entirely: a guided, multi-turn conversation instead of a single shot. It asks clarifying questions when your prompt is ambiguous, it lets you keep iterating on a rule after the first draft, and it works on more than blank-slate rule creation.
How the AI rule builder works
Rule Writer Agent runs a guided, multi-turn flow, not a single prompt-in, rule-out shot:
- Guardrail check. The prompt is screened before anything else happens, so a request outside what the rule engine can reasonably express gets caught early instead of producing something that looks like a rule but doesn't hold up.
- Prompt evaluation. The agent reads the request against your actual data model, not a generic schema, checking whether the pattern described maps cleanly to fields and logic that exist in your instance of Unit21.
- Build or ask. If the prompt is specific enough, it builds. If something's ambiguous, a threshold left vague, a population undefined, it asks, up to two or three clarifying rounds, rather than guessing and shipping a rule that doesn't match what you meant. In a regulated environment, getting the intent right matters more than getting an answer fast.
- Build and describe. The finished rule comes with a plain-language description alongside the compiled logic, so the next person who opens it doesn't have to reverse-engineer what it does.
That "build or ask" step is the difference between this and a one-shot generator. A rule that's wrong because the prompt was ambiguous is worse than no rule at all, since it creates false confidence. Asking first is slower by a few seconds and considerably faster than a rule that has to be found and rebuilt after it's already live.
It's not just for starting from scratch
The part of the new version that tends to land hardest in a live demo is that it isn't limited to net-new rules. You can bring an existing rule into Rule Writer Agent and iterate on it conversationally: duplicate a rule and refine it, open a rule recommendation from Rule Recommendations and adjust it in plain language before publishing, or start from one of Unit21's out-of-the-box templates and shape it to your data instead of using it as-is. You can even take a rule that's underperforming, feed the relevant details back into the chat, and ask for a specific change, like adding a variable, tightening a condition, or excluding a segment, without touching the underlying schema by hand.
That matters because most rules in production didn't start from a blank page. They started as a template from a sponsor bank, a rule ported over from a previous vendor, or a rule someone wrote years ago and never revisited. Rule Writer Agent gives every one of those rules the same on-ramp to plain-language iteration that a brand-new rule gets, so tuning isn't a one-time event tied to onboarding, it's something a team can keep doing.
What a request actually looks like
A prompt like "flag entities that receive five or more incoming wires from accounts opened in the last 30 days, totaling more than $50,000 in a rolling seven-day window" is specific enough that Rule Writer Agent can move straight to building: it generates the rule plan, compiles the logic, populates the variables (incoming wire count and incoming wire amount for new senders over a seven-day window, in this case) and trigger conditions, and hands back a rule with a summary explaining what it does and why.
A vaguer version of the same idea looks different. Something like "flag consumers making large card purchases that don't make sense based on their income" doesn't specify a data field, a dollar threshold, or a comparison method, so it's exactly the kind of prompt that triggers clarifying questions instead: which field represents income, what counts as a large purchase, should the comparison be a fixed threshold or a percentage of income, and over what time window. Answer those, and the agent builds a first working version, not a perfect one, but a meaningfully better starting point than a generic threshold nobody customized to the business. From there, you can keep talking to it: add a condition, exclude a segment, adjust a variable, and it updates the rule in place rather than starting over.
Either way, what comes out the other end is a rule your team can read and test, not a black box.
Who gets to write the rule
The value isn't just speed, though building a rule in minutes instead of days is real. It's who gets to build. Self-service rule creation only means something if the person closest to the pattern, the fraud analyst who just saw it, the compliance officer who just read the exam finding, can go from idea to tested rule without waiting on an engineer or learning a query language. Rule Writer Agent is what makes that person the one who actually writes the rule, and it works in the language they already think in: it understands plain English descriptions and other languages as well, so the barrier isn't fluency in a query syntax, it's just being able to describe what you're looking for.
It also means the rule that gets built is the rule that was meant, not an approximation of it. A rule description you can read in plain English is a rule you can audit, hand off, and defend to an examiner without translating it back out of the schema first. That auditability is a real differentiator against detection tools built as opaque, self-tuning models: you get the same low-effort path to a working rule, but with the explainability a rules-based system has always given you.
Rule Writer Agent isn't limited to onboarding, either. It's just as useful when an existing customer is launching a new product line or a sponsor bank is standing up a new program, situations that used to mean waiting on an FDE or an engineer to write a fresh batch of rules from scratch. Now that work can start the same day someone can describe the pattern they're worried about.
How it connects to Rule Recommendations
Rule Writer Agent is a companion to Rule Recommendations, not a replacement for it: Rule Writer Agent is how you build a new rule from an idea, Rule Recommendations (Insights Agent and Optimization Agent) is how you keep the rules you already have performing well. Together they cover both ends of the rule lifecycle, and they reinforce each other. A rule built well from the start with Rule Writer Agent produces cleaner, more consistently labeled dispositions, which is exactly the input Insights Agent and Optimization Agent need to generate a strong recommendation later. And any recommendation Rule Recommendations surfaces can be handed straight back to Rule Writer Agent to implement in plain language, rather than edited field by field. Read the companion post on Rule Recommendations for the other half of that loop.
What's live today
Rule Writer Agent is live now, available for customer and prospect conversations, and works for both entity- and instrument-based rules. It's available to every Unit21 customer, and the guided, multi-turn version described here is the one shipping broadly. Expect continued refinement as usage grows, this is an area the team is actively iterating on based on real usage, so feedback from testing it on your own data is genuinely useful.
How to use it
From the rule builder, choose "Generate a rule with AI," describe the pattern you're trying to catch, or start from one of the out-of-the-box prompts, and answer anything Rule Writer Agent asks in return. Review the generated rule, its description, and its variables before publishing, same as any other rule. You can also open it from an existing rule, a duplicated rule, or a rule recommendation to keep iterating instead of starting fresh.
Describe a rule, watch it get built
Bring a pattern you've been meaning to codify and see Rule Writer Agent turn it into a tested rule live.
Gal Perelman is the Product Marketing Lead at Unit21, where she spearheads go-to-market strategies for AI-driven risk and compliance solutions. With over a decade of experience in the fintech and fraud sectors, she has led high-impact launches for products like Watchlist Screening and AI Rule Recommendations.
Previously, Gal held marketing leadership roles at Design Pickle, Sightfull, and Lusha. She holds a Master’s degree from American University and a Bachelor’s from UCLA, and is dedicated to helping banks and fintechs navigate complex regulatory landscapes through innovative technology.
