-
-
E-Patrol Investigation uses GPT-5.6 for deterministic, read-only patrol analysis with traceable evidence and explicit limits.
-
Authorized administrators can investigate patrol activity through natural-language questions in a bilingual, read-only workspace.
Inspiration
Security patrol systems are very good at collecting operational records, but collecting data is not the same as understanding it.
Supervisors may have thousands of checkpoint scans, patrol notes, status records, timestamps, and photos across multiple locations. Finding an operational issue often requires manually opening reports, comparing dates, and checking individual records one by one.
E-Patrol is an existing security patrol platform developed by it-tude and already used in real operations across two client venues. As its historical data continued to grow, we asked a simple question:
What if a supervisor could investigate patrol activity by asking questions in everyday language?
That question inspired the E-Patrol Investigation Agent—an AI-assisted workspace that turns operational patrol data into explainable findings, supporting evidence, and clearly stated limitations.
What it does
The E-Patrol Investigation Agent allows an authorized supervisor to ask questions about patrol activity in Indonesian or English.
Examples include:
- How many scans occurred at a venue during a selected period?
- Which checkpoints were observed most frequently?
- Which registered checkpoints were never observed?
- How does activity compare between two venues or two periods?
- Were there unusually long intervals between scans?
- Which incidents require closer review?
- What evidence supports the conclusion?
Instead of giving the AI unrestricted database access, the workspace uses a set of controlled, read-only investigation tools:
- Scan activity summary — summarizes observed activity by venue, period, checkpoint validity, status, photo availability, and pseudonymized operator.
- Venue comparison — compares activity between current and previous periods.
- Checkpoint activity ranking — classifies registered checkpoints as observed, never observed, or historical orphan records.
- Incident timeline — returns a sanitized timeline of non-routine patrol findings and their supporting evidence.
- Scan interval analysis — detects unusually long intervals and groups related candidates for further investigation.
Each answer can include:
- A concise investigation summary
- The tool used
- Opaque evidence references
- Known data limitations
The agent assists human investigation; it does not make disciplinary or security decisions on its own.
How we built it
We extended the existing PHP and MariaDB-based E-Patrol platform with a separate investigation architecture.
The Build Week prototype uses a controlled, read-only snapshot containing:
- 2 operational venues
- 42 registered checkpoints
- 16,885 patrol records
- 338 securely linked image records
Codex helped us investigate the legacy repository, understand historical data relationships, identify unreliable identifiers, design deterministic evidence mappings, implement the investigation tools, create security boundaries, and build automated validation fixtures.
The investigation layer was intentionally separated from unrestricted production access. Its main components include:
- A dedicated read-only investigation datasource
- Authenticated and fail-closed investigation endpoints
- Tenant- and venue-scoped queries
- Deterministic patrol and image evidence mapping
- Pseudonymized operator identities
- Sanitized patrol notes
- Opaque media and evidence references
- Scope-bound pagination cursors
- Explicit limits and truncation reporting
- A bilingual Investigation Workspace integrated into the E-Patrol interface
- An AI orchestration layer that selects the appropriate investigation tool and returns an evidence-grounded response
The interface is available in both Indonesian and English so local security teams can work naturally while the project remains accessible to an international audience.
Challenges we ran into
The most difficult part was not generating an AI response. It was making sure the response could be trusted.
The original E-Patrol platform contains several years of real operational data. Some legacy relationships were incomplete or inconsistent. One historical patrol identifier, for example, could not safely be used as the primary relationship because many older records contained a zero value.
We also discovered that a naive image relationship could produce millions of incorrect candidates. We replaced it with deterministic mapping and verified that the final snapshot contained no orphaned image references and no cross-venue evidence leakage.
Other challenges included:
- Distinguishing registered checkpoints from historical orphan records
- Avoiding false assumptions about patrol sessions because no reliable roster or session table exists
- Protecting names, contact information, tokens, URLs, and other sensitive content inside free-text notes
- Preventing unauthorized access when the primary authentication context is unavailable
- Processing large periods without silently hiding truncated results
- Keeping every investigation read-only and reviewable by a human
When the available data cannot support a conclusion, the agent reports the limitation instead of inventing an answer.
Accomplishments that we're proud of
We are proud that this project is built on top of a working operational product rather than a fictional hackathon dataset.
During Build Week, we transformed years of patrol records into a secure investigation foundation and delivered five bounded investigation capabilities with evidence-aware responses.
Key accomplishments include:
- 16,885 real patrol records prepared in an isolated read-only snapshot
- 338 image records linked through deterministic mapping
- Zero orphan image references in the final evidence set
- Zero cross-venue evidence leakage in validation
- Five investigation tools exposed through controlled endpoints
- Unauthorized endpoint requests rejected instead of falling back to unsafe access
- Operator identities pseudonymized
- Sensitive patrol notes recursively sanitized
- Analysis limits and data limitations explicitly reported
- Internal test and integration fixtures restricted to command-line execution
- A bilingual Investigation Workspace integrated with the existing E-Patrol visual system
- AI responses that identify the tool used and return traceable evidence references
Most importantly, the system does not hide uncertainty. If patrol-session, shift, roster, or historical relationship data is unavailable, that limitation remains visible to the supervisor.
What we learned
We learned that adding AI to an operational system is not mainly a prompting problem.
Before an AI agent can provide a useful answer, the underlying application needs:
- Clear tenant and venue boundaries
- Reliable data relationships
- Deterministic tools
- Sanitized context
- Evidence provenance
- Explicit uncertainty
- Human oversight
We also learned that legacy data should not be forced into a cleaner story than it can support. Sometimes the correct engineering decision is to classify a record as historical, report a limitation, or refuse to infer a patrol session.
Codex was particularly valuable as a long-running engineering collaborator. It helped us inspect the existing codebase, identify unsafe assumptions, implement bounded tools, create validation tests, and repeatedly review the system until the investigation layer behaved consistently.
The result changed our perspective: an effective enterprise AI agent should not simply sound intelligent—it should be able to show where its answer came from and what it still does not know.
What's next for E-Patrol Investigation Agent
Our next steps are to expand the Investigation Agent without weakening its evidence and privacy boundaries.
Planned improvements include:
- More natural follow-up questions within the same investigation
- Supervisor feedback and expert-correction workflows
- Saved investigation cases and review history
- AI-assisted risk prioritization
- Controlled photo understanding for authorized incident evidence
- Scheduled daily and weekly investigation summaries
- Multi-venue trend monitoring
- Alerts for repeatedly missed or inactive checkpoints
- Exportable investigation reports with evidence citations
- Evaluation datasets created from supervisor corrections
- Deployment to existing E-Patrol clients through a controlled rollout
The long-term goal is not to replace security supervisors. It is to give them a faster, safer, and more explainable way to understand what is happening across their patrol operations.
Log in or sign up for Devpost to join the conversation.