SIPAR Command — National Cyber Fusion & Command Centre

Governance · agentic layer

The agentic layer, and its limits

Fourteen specialists do the reading, the correlation and the drafting. Not one of them can approve, submit, block, freeze or decide. That line is enforced in code and visible on every card.

13 proposalsPolicy Guard active

Runtime

goal → proposal → signature

Trigger

Orchestrator

Planner

Specialists

Tool registry

Sandbox

Policy Guard

Approval queue

Audit ledger

Approval queue

a named officer signs every action

writes to the audit ledger

Signed as Ayesha Karim · Director General

Proposal — not a decisionA9 Liaison81%critical

Request CDR for 2 numbers under warrant W-2026-0142

EV-_022NCCIA/CC/2026/3131raised —

Proposal — not a decisionA8 Content Review78%medium

Decline removal of 1 content item — no statutory violation

EV-_020no case linkedraised —

Proposal — not a decisionA1 Sentinel Intake55%low

Re-route 5 complaints from Cyber Crime Wing to Financial Crime Wing

EV-_016NCCIA/CC/2026/3125raised —

Proposal — not a decisionA13 Citizen Shield68%low

Send status update and referral to victim support in Lahore

EV-_010NCCIA/CC/2026/3119raised —

Proposal — not a decisionA3 Forensic Orchestrator55%low

Queue 6 exhibits for re-examination after tool validation gap

EV-_013NCCIA/CC/2026/3122raised —

Proposal — not a decisionA4 Network Evidence71%low

Attach PCAP-derived session list to case 3121

EV-_012no case linkedraised —

Proposal — not a decisionA12 Digital Twin Analyst83%medium

Ingest telecom topology into twin layer 6 (proposed)

EV-_017no case linkedraised —

Proposal — not a decisionA11 Predictive Analyst76%low

Publish internal early warning on wallet-rail mule spike

EV-_019NCCIA/CC/2026/3128raised —

Proposal — not a decisionA7 Crypto Tracer85%medium

Escalate off-ramp attribution to PVARA for VASP data

EV-_011no case linkedraised —

Proposal — not a decisionA13 Citizen Shield65%low

Close 4 citizen tickets as resolved with advice

EV-_021no case linkedraised —

Proposal — not a decisionA6 Financial Trace89%high

Issue victim-list to 3 banks for account sweeps, case 3133

EV-_018no case linkedraised —

Proposal — not a decisionA9 Liaison61%critical

File MLA request for foreign-hosted evidence, case 3130

EV-_015no case linkedraised —

Proposal — not a decisionA10 Case Builder83%medium

Flag case 3126 as not ready — corroboration below threshold

EV-_014no case linkedraised —

9 approved · 0 rejected · 13 openAgents never sign for themselves

Autonomy ladder

L1 → L4

Observe

Reads and summarises only. Briefings and dashboards.

Recommend / draft

Produces drafts for a human. Partner requests, reports, case merges.

Act after approval

Executes once a named officer approves. Preservation, blocks, freezes, advisories.

Act and report

Low-risk, reversible, internal only. Triage, de-duplication, forensic parsing.

Human only — never an agent

Arrest and raid
Charging decisions
Attribution to a natural person
Public disclosure about an individual
Operating covert personas
Enforcement action on speech
Asset confiscation or payout decisions

Sovereign stack

no outbound calls

Datastore: SQLite · WAL · local file
Agent brain: Asterxa API (live)
Vault label: nccia
Egress: None by default
Audit: Append-only, hash-chained

Ask a specialist

Asterxa API · proposal only

Asterxa · livevault label · nccia

Calls go server-side to the Asterxa API. The key is never sent to the browser.

Specialist agentTurns a goal into a task graph; assigns specialists, budgets and deadlines.

Ask the agent

Output is a proposal. It cannot approve, submit, block or decide anything.

Agent roster

14 specialists

#	Agent	Purpose	Level	Tools	Measured	Status
A0	Orchestrator	Turns a goal into a task graph; assigns specialists, budgets and deadlines.	L2	Workflow engine, Case & Mission Ledger	Plan acceptance 94% · cycle time 6m 12s	active
A1	Sentinel Intake	Triages every complaint: typology, urgency, routing, duplicates.	L4	Speech & Script Engine, Pakistani-language NLP	Triage accuracy 93.4% · median 7m 40s	active
A10	Case Builder	Assembles the electronic case file and scores prosecution readiness.	L2	Timeline, Hash & Similarity	ECS pass rate 78% first submission	active
A11	Predictive Analyst	Forecasts volume and typology drift with published confidence bands.	L1	Predictive Engine	MAPE 9.8% at 7 days	active
A12	Digital Twin Analyst	Maintains the seven-layer national model and runs what-if simulations.	L1	Twin Simulation Engine, Geospatial	Model freshness 4m	paused
A13	Citizen Shield	Keeps the complainant informed and drafts victim-support referrals.	L2	Case & Mission Ledger, Speech & Script Engine	Status accuracy 99.1% · CSAT 4.4/5	active
A2	OSINT Recon	Public-source enrichment of usernames, domains and numbers with preserved captures.	L4	OSINT Collection Engine, Hash & Similarity	Hit rate 71% · capture completeness 97%	active
A3	Forensic Orchestrator	Runs lab analysis and assembles timelines, artefacts and reports.	L4	Acquisition, Disk & File	Jobs inside SLA 91.2%	active
A4	Network Evidence	PCAP and flow analysis producing sessions, alerts and findings.	L4	Network Evidence Engine	Coverage 88% · false positives 4.1%	active
A5	Malware Analyst	Sample analysis producing capabilities, IOCs and signatures.	L4	Malware Detonation Lab, Hash & Similarity	Median turnaround 3h 05m	active
A6	Financial Trace	Follows mule chains across banks, wallets and 1LINK rails to a named account.	L3	Financial Trace Engine, Case & Mission Ledger	Chain resolution 84% · holds in 22m	active
A7	Crypto Tracer	Labels wallets, follows off-ramps and drafts exchange freeze requests.	L3	Crypto Trace Engine	Attribution 61% · freeze response 46m	active
A8	Content Review	Classifies reported content against the statutory schedule with safeguards attached.	L2	Hash & Similarity, Policy Guard	Reviewer agreement 89% · never auto-acts	active
A9	Liaison	Drafts preservation, disclosure, INTERPOL and MLA requests with SLA tracking.	L2	Case & Mission Ledger, Inter-Agency Bus	On-time filing 96%	degraded

Recent runs

last 12

Agent	Output	Action	Conf.	Started
A8	Refer 2 content items for legal review under the statutory sched	regulated	56%	—
A9	Request CDR for 2 numbers under warrant W-2026-0142	regulated	81%	—
A8	Decline removal of 1 content item — no statutory violation	regulated	78%	—
A9	Raise INTERPOL diffusion request for cross-border suspect identi	regulated	62%	—
A2	Preserve 14 public captures relating to domain trendfinance[.]pk	enrich	75%	—
A1	Re-route 5 complaints from Cyber Crime Wing to Financial Crime W	enrich	55%	—
A9	Send preservation request to platform for subscriber records, ca	regulated	76%	—
A13	Send status update and referral to victim support in Lahore	enrich	68%	—
A6	Place a 24-hour hold on account PK36SCBL0000001123456702 (Rs 1,8	regulated	55%	—
A3	Queue 6 exhibits for re-examination after tool validation gap	enrich	55%	—
A4	Attach PCAP-derived session list to case 3121	enrich	71%	—
A12	Ingest telecom topology into twin layer 6 (proposed)	regulated	83%	—

Audit ledger

append-only

NCII_ESCALATED2026-10-30 11:09

Ayesha Karim · Victim & Gender Desk · ncii_removal

fd109e55…25167d ← efb897f9…7b6a98

NCII_ESCALATED2026-10-30 11:09

Ayesha Karim · Victim & Gender Desk · ncii_removal

efb897f9…7b6a98 ← f3c32fd7…18254a

COMPLAINT_TRIAGED2026-10-30 11:06

Citizen Shield · Citizen intake · complaint

f3c32fd7…18254a ← c8625a94…c67dd4

APPROVAL_GRANTED2026-10-30 10:24

B. Raza · Officer · approval

c8625a94…c67dd4 ← e3702368…0ff4bb

APPROVAL_GRANTED2026-10-30 09:41

S. Malik · Officer · approval

e3702368…0ff4bb ← 0f4a7f68…7cb4f2

APPROVAL_GRANTED2026-10-30 08:57

S. Malik · Officer · approval

0f4a7f68…7cb4f2 ← 4a15e93b…26d98c

APPROVAL_GRANTED2026-10-30 07:26

H. Qureshi · Officer · approval

4a15e93b…26d98c ← 440660f1…1afb53

EXHIBIT_SEALED2026-10-30 07:25

S. Sheikh · Analyst · complaint

440660f1…1afb53 ← da98d206…810c54

APPROVAL_GRANTED2026-10-30 06:31

O. Farooq · Officer · approval

da98d206…810c54 ← 6f49d73b…847565

FORECAST_PUBLISHED2026-10-30 03:55

U. Tariq · Supervisor · mission

6f49d73b…847565 ← aaa68d6a…a476f9

APPROVAL_GRANTED2026-10-30 03:23

H. Qureshi · Officer · approval

aaa68d6a…a476f9 ← 9124d098…d022f1

APPROVAL_GRANTED2026-10-30 02:49

S. Malik · Officer · approval

9124d098…d022f1 ← d553e2a5…826dfc

COMPLAINT_TRIAGED2026-10-30 01:40

R. Hassan · Officer · warrant

d553e2a5…826dfc ← 78cc7c25…bd5c9b

APPROVAL_GRANTED2026-10-30 01:33

A. Karim · Officer · approval

78cc7c25…bd5c9b ← ea1d1c26…ac1dfb

What the document says, and what this build does

no overclaiming

The architecture defines A0–A5 by name and scope; this build keeps those verbatim. A6–A13 are scoped to the wings the document defines and are marked illustrative in the roster above. Measured figures are illustrative operating targets, not audited results.

Asterxa is wired as the agent brain over a server-side key held under the vault label nccia. With no key, this surface returns a labelled placeholder rather than an invented answer — the one failure mode that would be worse than no answer at all.