The LP investigator
Your day
Triage the case queue. Investigate active cases. Coordinate with district when organized retail crime patterns emerge. Refer substantiated cases to civil services through Legal & Compliance.
What the platform does for you
- Continuous detection rule evaluation across the full transaction stream. Rules fire on anomalous patterns; cases queue automatically.
- Pattern correlation across stores. Single-store detections that match a known organized retail crime fingerprint surface as district-level investigation candidates.
- Asset filter so fixtures don't generate false positives. Items classified as non-saleable assets are excluded from shrink-rule evaluation automatically.
- Hash-anchored evidence chains that hold up in court without you assembling a binder. The chain IS the binder — every event timestamped, sequenced, and verifiable by an external party.
- Allow-list management. Known-good patterns (a category with naturally high return rates, a vendor with a known seasonality fingerprint that mimics fraud) can be allow-listed with scope and expiry.
Where you step in
| Decision | Trigger | What you do |
|---|---|---|
| Case triage | Detection candidate queued | Open as case or dismiss as noise |
| Investigation judgment | Active case under review | Read the floor — the data surfaces, you interpret |
| Allow-list configuration | Known-good pattern triggering false positives | Define scope and time bound; agent applies |
| Civil-services referral | Substantiated case ready for external action | Coordinate with Legal & Compliance; never direct |
| Cross-store ORC investigation | Local Market Agent surfaces a pattern | Lead the district investigation; Fox cases link |
What the platform never asks of you
- Querying four systems to assemble case context — the case timeline IS the chain.
- Building the evidence binder by hand — the chain is the binder.
- Tracking ORC patterns across stores manually — the Local Market Agent surfaces them.
- Calling civil services directly — Legal & Compliance owns the gate; you coordinate, you do not communicate.
- Manually correlating CCTV with transaction data — the field-capture pipeline links physical evidence to chain events at the moment of capture.
- Maintaining a private spreadsheet of suspected patterns — the platform's allow-list and detection rule library hold the patterns formally.
What's on your dashboard
| Tile | What it shows |
|---|---|
| Case queue | Open cases, new candidates, escalations from store managers, ranked by severity |
| Detection alerts | Real-time rule firings; cashier-correlated patterns; cross-store correlations |
| Shrink attribution | This week's shrink with breakdown by case status and rule family |
| Pattern correlations | Local Market Agent signals; stolen-product resale candidates; flash mob coordination signals |
| Civil services queue | Cases approved by L&C for external referral; warrant notifications inbound |
| ORC watchlist | Cross-store patterns under investigation; subjects-of-interest flagged across the district |
What's structurally different from before
Traditional LP at SMB scale runs on whatever the manager remembers and whatever the POS report happens to surface. Canary changes the substrate.
| Before | After |
|---|---|
| Notice a pattern. Pull reports. Cross-reference. Assemble. Maybe miss the data window. | Pattern detected by rule. Case auto-queued. Evidence chain auto-assembled. Decision is yours. |
| Investigate cases one at a time. Cross-store patterns invisible. | Pattern correlation across stores; district investigation enabled by default. |
| Build the case binder for handoff to law enforcement. | The chain is the binder. Civil-services referral via L&C with verifiable evidence. |
| Chase a CCTV clip from operations. | Field-capture links physical evidence to chain events at the moment of capture. |
The platform does not replace LP judgment. It removes the work between the signal and the decision.
Related
- The store manager — escalation source for store-level concerns
- The merchant — destination for shrink-rate trend reporting
- The external party — auditors and law enforcement consume the same chain you investigate against