Argus

The problem

90% of world trade moves by sea, and the ships that matter most to security are the ones that stop telling you where they are. A tanker goes dark for three hours inside a subsea cable corridor. Two hulls meet at sea for a transfer nobody declared. One MMSI reports from two places at once, five hundred miles apart.

Coast guards, navies, sanctions enforcement teams, insurers and port authorities all watch the same AIS stream, and they all hit the same wall. Detection is solved: a rule finds a gap in seconds. Judgement is not. Before anyone can act, someone has to answer who owns this ship, where it has been flagged, whether the operator is sanctioned, has it done this before, and whether any of it is worth a satellite tasking that costs real money. That work takes a trained analyst 30-60 minutes per vessel, and a single watch floor sees dozens of candidates a shift. The backlog is where threats hide.

The instinct is to point a large language model at the problem. That fails the moment it meets an operational floor, because a watch officer cannot act on an answer they cannot verify, and no maritime authority will let a model task a satellite or clear a vessel on its own.

What Argus is

Argus is a maritime watch floor where AI agents do the investigation, and a human officer makes every decision. It closes the gap between detection and judgment without asking anyone to trust a black box.

Live AIS comes in across six watched regions. Every thirty minutes, deterministic detectors and a Watch agent turn twelve hours of positions into alerts, each carrying its own evidence and time window. An alert opens a durable investigation: two lines of enquiry run in parallel, identity, ownership and sanctions on one side, behaviour on the other, merged by code rather than by a model. The result is a Vessel of Interest report with a headline, a timeline, indicators and counter-indicators, the information gaps it could not close, and recommended actions, in which every single claim cites the tool that produced it. If satellite imagery would settle the question, a Tasking agent would write the collection request and stop there.

Then the system waits. Officers accept, reject and approve. Nothing is tasked, and nothing is closed by a model. Every state change is an append-only audit event naming the actor, human or agent, so a decision made at 03:00 can be reconstructed in an inquiry two years later.

A full investigation on live data takes about a minute and costs a few cents.

Who it helps and how

Coast guards and navies get a triaged queue instead of a raw feed: the forty gaps that arrive each morning are already investigated, ranked, and have the evidence attached, so watch officers can focus their attention on the three that matter.

Sanctions and compliance teams get an audit trail built for scrutiny. Every finding is traceable to the tool call and the frozen data snapshot behind it, and to the provenance manifest records, which record the prompt and model version that produced each section of the report.

Insurers and port authorities get a consistent, explainable risk picture of vessels approaching their waters or their books, at a per-assessment cost low enough to run on every hull rather than only on those someone happened to flag.

Satellite operators and their customers stop wasting collection budget: imagery is proposed only where an evidence gap justifies it, and a human signs off before a task is placed.

The design principle underneath all of it is that the system is useful precisely because it refuses to overreach. Agents propose; officers decide.

Design decisions that make it operational

The investigation sequence lives in code, not in a planner. The Orchestrator is a state machine. No model chooses which agent runs next, so every run is reproducible, its cost is bounded, and a failure has one place to look. The only model call the Orchestrator makes itself is the report draft, and that draft must pass a policy check or be redrafted with the corrections listed.

Detection is deterministic; judgement is the model's job. Detectors compute the anomaly and fix the vessel, the window and the evidence. The Watch agent only decides whether to raise a candidate and writes the reason. Two kinds of anomaly cannot be dismissed at all, because an MMSI in two places is not a matter of opinion. This one decision took evaluation recall from a coin flip to a stable floor.

Every claim cites its source. Evidence is recorded as server.tool, snapshots of the underlying data are frozen at completion, and a report that cites nothing or recommends an action outside the allowed set is rejected before it reaches an officer.

Human-in-the-loop is enforced in the API, not promised in a prompt. Agents can only create proposed rows. Approval is a separate endpoint with a separate permission. Review state and approval status are separate columns, because reviewing a claim and authorising an action are different acts.

Least privilege everywhere. One IAM role per agent, a model allowlist limited to first-party Bedrock models, tool access governed by a Cedar policy engine at the gateway, and the agent runtimes in subnets with no route to the internet. If an agent is compromised, there is nowhere for it to send data.

Personal data is protected by construction. Beneficial owner names exist only as encrypted columns, decrypted by exactly one tool for exactly one lookup; the API and the user interface stay pseudonymous.

How it is built

Four agents on two frameworks, chosen per agent: Strands Agents for the tool heavy loops, LangGraph for the graphs whose structure must be fixed. Amazon Nova by tier, with escalation on provider errors. Twenty four Model Context Protocol tools across four servers over PostGIS, which are the only path from an agent to data.

Amazon Bedrock AgentCore provides the platform layer: nine Runtime endpoints, two Gateways (one over the tool servers with a Cedar policy engine in enforce mode, one for agent to agent calls), the AWS Agent Registry for discovery, Identity for third party credentials, Memory so a repeat investigation starts where the last one ended, online Evaluations, a Guardrail on every model call, and versioned managed prompts.

A FastAPI service is the system of record. Long work never runs inside a request: the API writes a job row and publishes an id to one of two SQS queues, and a worker per queue picks it up with a visibility heartbeat and a reclaim path for crashed workers. Aurora Serverless v2 with PostGIS holds positions partitioned by day, evidence snapshots and the append only audit log. An Application Load Balancer runs Cognito sign in on every listener with AWS WAF in front. OpenTelemetry feeds both a self hosted Grafana stack and CloudWatch, with thirty one alarms on one topic. Everything is four AWS CDK stacks, deployed or destroyed with a single command, with cdk-nag on every synthesis.

Quality has a gate: per agent evaluation suites with regression floors (Watch recall 0.8, evidence traceability 0.9, report rubric 3.5 of 5) that a prompt or model change must pass before it ships.

What we learned

Small models need rails, not longer prompts; handing a model fixed candidates and asking only for a decision was worth more than any amount of prompt engineering. Reproducibility comes from code, not from a planner. Guardrails calibrated in the abstract block real work, so they must be tuned against live traffic. And observability pays for itself in the first incident: three separate production faults were each diagnosed from logs and metrics in minutes rather than hours.

Roadmap

Now, hardening for pilot use. Feed the vessel's own position into the tasking decision rather than letting the model supply an area of interest; cap report confidence when a line of enquiry degrades; deduplicate and age alerts so the queue stays actionable across a long watch; run the evaluation gate continuously against the deployed stack.

Next, resilience and scale. Multi-zone agent placement, two tasks per service so deployments never dip to zero, a heartbeat alarm on the live feed, a backup-and-restore runbook for the seven-year record, and cost guardrails with budget alerts.

Then, coverage and capability. More detector families (course reversals near boundaries, speed profiles inconsistent with the declared ship type, port call anomalies), per region zone sets and sweep cadences, and additional data planes behind the same tool contract: vessel registries, port state control records, and optical as well as radar imagery.

Beyond that, the operating model. Bulk review and case queues for a full watch team, officer notes carried into the audit trail, exportable case files for handover to prosecutors or insurers, and a tenant model so a coast guard, an insurer and a port authority can run isolated deployments from the same infrastructure as code.

The destination is not a bigger model. It is a system a watch officer trusts at three in the morning, and an inquiry can still be reconstructed three years later.

Built With

• a2a
• aisstream
• amazon-bedrock
• amazon-cloudwatch
• amazon-cognito
• amazon-ecs
• amazon-eventbridge
• amazon-nova
• amazon-sqs
• aurora-serverless
• aws-cdk
• aws-fargate
• aws-waf
• aws-x-ray
• bedrock-agentcore
• fastapi
• grafana
• langchain
• langgraph
• model-context-protocol
• opensanctions
• postgis
• postgresql
• redis
• strands-agents