How does alert triage work in the Tazama Case Management System (CMS)?

A single system setting, configured by your administrator - the triage mode - controls what happens to a case after an alert is generated. There are three modes: (1) Manual triage (the current setting in the Beta Sandbox) - every new alert creates a "Complete New Case" task in the shared Investigations queue; an investigator reviews the alert evidence and records a judgement (Fraud, AML, or both; a priority, which sets LOW/MEDIUM/HIGH and an SLA deadline; a confidence level; and a mandatory note). Based on that judgement the case is closed immediately or sent for full investigation. If an alert indicates both fraud and money-laundering, two linked cases are automatically created so each specialist team can work independently. Manual triage also builds the labelled historical dataset a future AI model would need to learn from. (2) AI triage (for future use, once sufficient labelled data exists) - a machine-learning model reviews the alert first. Low-confidence predictions are always routed to a human - the AI never quietly discards an alert it is unsure about. High-confidence false alarms are auto-closed as refuted (but can always be reopened). High-confidence genuine alerts can only be auto-closed if the transaction was actually blocked in time and there is no money-laundering suspicion - otherwise a human must investigate, which is a regulatory requirement the AI cannot override. (3) Disabled - no triage step at all; every alert goes straight to the investigation queue. This is the built-in default and safety fallback if the setting is missing or misconfigured. Source: Tazama Product Owner, #tazama-public-beta, July 2026.