Forensic Audit Ledger Tool Registry Definition Brief

Role: Senior Forensic Technology Director specializing in automated financial anomaly detection and e-discovery systems.

Context

• Audit Practice: {{accounting_firm}}
• Ledger Data Platform: {{target_ledger_database}}
• Investigation Typology: {{anomaly_detection_rules}}
• Execution Compute Budget: {{max_token_budget_per_call}}
• Data Access Boundary: {{read_permission_scope}}
• Evidentiary Logging Sink: {{audit_trail_sink}}

Task

Author a forensic tool calling registry brief establishing verified function interfaces that allow audit agents to query, cross-examine, and flag suspicious ledger activity while preserving a tamper-proof chain of custody.

Method

1. Identify necessary database query primitives tailored to {{target_ledger_database}} and the scope of {{read_permission_scope}}.
2. Write granular function signatures for querying general ledgers, sub-ledgers, vendor masters, and transaction audit trails.
3. Embed strict parameter validation checks that enforce bounded date ranges, account masks, and threshold minimums.
4. Design deterministic anomaly triage tools aligned with the specific indicators outlined in {{anomaly_detection_rules}}.
5. Implement strict token allocation controls to guarantee tool payloads do not exceed {{max_token_budget_per_call}}.
6. Direct all function execution telemetry, input arguments, and raw returned records to {{audit_trail_sink}} for legal defensibility.
7. Formulate explicit stop-criteria functions to halt automated investigation when potential system abuse is detected.

Constraints

• Function definitions MUST enforce parameterized SQL or API filters to eliminate arbitrary query injection risks.
• The model MUST NOT be granted access to execute dynamic raw SQL scripts without pre-compiled templates.
• All generated function outputs MUST include a cryptographic hash of the retrieved record set.
• Telemetry sinks must capture full prompt-to-tool argument traces for every investigative step.

Output format

• Section 1: Forensic Tool Registry Specification (3-4 complete function signatures with argument types and bounds)
• Section 2: Data Boundary & Query Sanitization Rules (bulleted list of parameter constraints)
• Section 3: Evidence Chain & Audit Logging Flow (diagrammatic text flow outlining write operations to the sink)
• Section 4: Investigation Stop-Criteria & Circuit Breakers (numbered policy triggers)

Self-review

• Confirm that no function permits unconstrained table scans or wildcards in string queries.
• Verify that the audit trail logging mechanism preserves evidence integrity suitable for courtroom submission.
• Ensure payload caps match the token constraints specified in the execution compute budget.