21 predefined natural-language queries, each wired to a deterministic drill path over the CRDM. Merchants ask in plain English; the dashboard surfaces the z-score outliers and drills into the supporting transactions.
Each entry maps a question to a drill order (by_employee, by_location, by_day, default) and a set of canonical filters. No pre-built SQL — the drill path builds the query at runtime against tenant-scoped tables.
Source: canary/services/risk_dictionary.py · Issue: GRO-223
Employee Risk 4 queries
| Label | Question | Severity | Drill Order | Canonical Filters |
|---|
| Top Refund Employees | "Who are the top employees by refund volume?" | high | by_employee | transactions.transaction_type equal RETURN |
| Top Void Employees | "Which employees process the most voids?" | high | by_employee | transactions.transaction_type in_list VOID, POST_VOID |
| Employee Discounts | "Are any employees applying excessive discounts?" | high | by_employee | transactions.discount_amount_cents greater_than 0 |
| Highest Avg Transaction | "Which employee has the highest average transaction value?" | medium | by_employee | transactions.transaction_type equal SALE |
Payment Anomalies 3 queries
| Label | Question | Severity | Drill Order | Canonical Filters |
|---|
| Refund Rate by Employee | "Which employees have the highest refund rate this week?" | high | by_employee | transactions.transaction_type equal RETURN |
| Void Spikes | "Are there any void spikes compared to the weekly average?" | high | default | transactions.transaction_type in_list VOID, POST_VOID |
| After-Hours Transactions | "What transactions happened after business hours?" | medium | default | — |
Product Risk 4 queries
| Label | Question | Severity | Drill Order | Canonical Filters |
|---|
| Product Return Rate | "What products have the highest return rate?" | high | by_product | transactions.transaction_type equal RETURN |
| Most Discounted Items | "Which items get the most discounts applied?" | medium | by_product | transaction_line_items.total_discount_cents greater_than 0 |
| High-Value Void Items | "Show me high-value items with unusually high void rates" | high | by_product | transactions.transaction_type in_list VOID, POST_VOID |
| Shrinkage Risk Products | "What are my top shrinkage-risk products?" | high | by_product | transactions.transaction_type in_list RETURN, VOID, POST_VOID |
Tender Patterns 5 queries
| Label | Question | Severity | Drill Order | Canonical Filters |
|---|
| Split Tenders | "How often are transactions split across multiple tenders?" | medium | default | — |
| Cash vs Card Breakdown | "What percentage of transactions are cash vs card?" | low | default | — |
| High Cash Periods | "Are there periods with unusually high cash transactions?" | high | default | transaction_tenders.tender_type equal CASH |
| Repeated Card Usage | "Show me cards used more than 5 times today" | high | default | — |
| Manual vs Chip/Tap | "What is the manual key-entry rate compared to chip/tap?" | medium | default | transaction_tenders.entry_method equal KEYED |
Time Patterns 5 queries
| Label | Question | Severity | Drill Order | Canonical Filters |
|---|
| Peak Refund Hours | "What hour of the day has the most refunds?" | medium | default | transactions.transaction_type equal RETURN |
| Weekend vs Weekday Voids | "Compare weekend vs weekday void rates" | medium | default | transactions.transaction_type in_list VOID, POST_VOID |
| Volume Spikes | "Are there any unusual spikes in transaction volume?" | medium | default | — |
| Manual Entry by Hour | "Show me hours with the most manual entry transactions" | medium | default | transaction_tenders.entry_method equal KEYED |
| High-Value Refund Timing | "When do most high-value refunds happen during the day?" | high | default | transactions.transaction_type equal RETURN |
How It Works
- Merchant clicks a Risk Dictionary tile on the dashboard.
- The
drill_order feeds the same hierarchical drill engine as dashboard tiles (by employee → by location → by day → transactions).
- Filters are applied to the CRDM under tenant-scoped RLS — merchant only sees their own data.
- Z-score outlier detection surfaces the top deviations; click a row to see the supporting transactions.
