Event in, signal out, action back
The core platform emits events — logins, bookings, collections, payouts, report uploads — over a private internal channel. Sentinel queues them idempotently, runs each through its rule engine to raise weighted fraud signals, recomputes the entity’s risk score, and — when risk turns critical — calls back into the core to block the lab or remove the phlebotomist.
Ingest
Events arrive via an internal x-internal-key endpoint, deduplicated by event ID and logged against the entity profile.
Evaluate
BullMQ workers run the event through every matching rule — velocity windows, GPS checks, duplicate-identity lookups, behavioral baselines.
Score
Active signal weights are summed (capped at 100) into a live risk score with a Low / Medium / High / Critical band.
Act
Score ≥ 25 raises an alert; Critical (≥80) auto-blocks — the lab is deactivated or the phlebo removed on the core API instantly.