Engine spec · v3
MantaRay™.
The overtime intelligence engine.
Twelve behavioural detection models. Entity-level risk scoring. Adaptive banding. Continuous assurance. MantaRay™ turns raw payroll exports into defensible, board-ready findings — in seconds.
12
Detection models
5
Report types
$200M
Transactions scored
<2 min
Time to findings
01 / Pipeline
From CSV to entity risk score in four stages.
01
Ingest
Drag-and-drop CSV/XLSX up to 200MB. Five-column mapping (claimant, hours, value, date, approver). Type inference, locale-aware date parsing, duplicate detection.
02
Standardise
Normalisation across rate codes, period boundaries and rosters. PII-minimised: employee identifiers + transaction data only. No names, no addresses required.
03
Score
Twelve detection models run in parallel against transaction, claimant, approver and dyad surfaces. Aggregated into entity-level scores with adaptive banding.
04
Surface
Five report types — Executive, Actionable Intelligence, Leakage, Integrity, Approval Dependency. Findings filed by risk band with full evidence appendix.
02 / Detection surface
Twelve models, one explainable score.
Each model operates over a different behavioural surface — temporal, relational, distributional, structural. Scores aggregate at the entity level (claimant, approver, dyad, unit) using transparent weights, not opaque deep nets.
Model
Consistency variable
Proprietary rhythm engine quantifying temporal harmony in overtime activity.
Model
Leakage compounding
Persistent sub-threshold claims aggregating into material exposure.
Model
Peer-relative outliers
Z-scored divergence from same-role, same-roster, same-period peers.
Model
Approver dependency
Approver–claimant graph concentration — single points of approval failure.
Model
Collusion signals
Reciprocal and circular approval patterns across the workforce graph.
Model
Distributional anomalies
Benford and digit-frequency tests on claim values and hours.
Model
Trend acceleration
Units or claimants whose claims grow outside expected variance bands.
Model
Roster contradiction
Claims that conflict with documented shift, leave or unavailability records.
Model
Approval velocity
Approvers acting faster than humanly review-plausible across batches.
Model
Threshold gaming
Claims clustering just below approval-tier or audit-trigger thresholds.
Model
Behavioural outliers
Per-role, per-grade pattern divergence beyond expected behavioural baseline.
Model
Recurrence signature
Day-of-week and hour-of-day repetition patterns inconsistent with operational need.
Adaptive risk banding
Low
Moderate
Elevated
High
Critical
Bands re-calibrate per cohort. A claim flagged Critical in one organisation would be Moderate in another — thresholds are derived from the cohort distribution, not hard-coded.
03 / Conceptual layer
The mathematics underneath.
Every model in MantaRay™ is a composition of well-defined statistical operators — no black boxes, no opaque neural weights. Each score is decomposable back to a closed-form expression a quantitative analyst can audit, reproduce, and defend in front of a tribunal.
Operator
Standardised z-transforms
z = (x − μ) / σₙ₋₁
Sample standard deviation (Bessel-corrected, n−1 denominator) preserves an unbiased variance estimator across small cohorts and small-sample tail behaviour.
Operator
Log-compressed monetary surface
ŷ = log₁(1 + Σvᵢ)
log1p contracts the long right tail of overtime value while remaining numerically stable at zero — keeps the distribution Gaussian-friendly for parametric scoring.
Operator
Min-max contraction
x̃ = (x − min) / (max − min)
Bounded affine rescaling onto [0, 1] before signal aggregation — guarantees commensurable units across heterogeneous feature axes.
Operator
Multi-signal arithmetic mean
S = (1/k) · Σᵢ sᵢ
Equal-weighted aggregation of k independent normalised signals — maximises score robustness against any single-axis perturbation by central-limit smoothing.
Operator
Adaptive threshold descent
τₜ₊₁ = τₜ − Δ while |Critical| = 0
Iterative threshold relaxation: start at τ = 3.2σ, decrement by 0.1σ until the critical-band cardinality is non-empty, floor at 2.8σ. Convergent in ≤ 4 iterations.
Operator
Bipartite approval graph
G = (C ∪ A, E), w(c,a) = Σvₑ
Claimant–approver edges weighted by aggregate approved value. Self-edges where c = a are upgraded categorically — graph topology overrides distributional score.
Operator
Digit-frequency divergence
D_KL(P || Benford)
Kullback–Leibler divergence of observed leading-digit frequencies against Benford's logarithmic distribution P(d) = log₁₀(1 + 1/d). Detects manual fabrication signatures.
Operator
Two-gate persistence operator
𝟙[ν ≥ ν*] · 𝟙[ρ ≥ ρ*]
Indicator product of materiality floor ν* (dataset-month scaled) and persistence floor ρ* — only claimants crossing both gates enter the leakage score surface.
Operator
Oriented z-score projection
z⃗ = sign(∂risk/∂x) · z
Signed projection of z-vectors onto the risk-monotone direction — symmetric divergence becomes one-sided risk, so peer-relative under-claimants don't contaminate the score.
Operator
Consistency variable
C = 1 − H(τ) / H_max
Proprietary rhythm operator: normalised entropy of inter-claim temporal spacings τ. Low entropy → mechanical regularity inconsistent with operational need.
Operator
Cohort-conditional banding
band(z) = F⁻¹_cohort(Φ(z))
Bands are quantile-mapped through the empirical cohort CDF, not fixed cut-points. A Critical claim in one cohort is a Moderate claim in another — calibration is endogenous.
Operator
Entity-level rollup
R_e = max_i sᵢ ⊕ Σᵢ vᵢ
Per-entity score is a tuple of distributional extremum (max signal) and exposure aggregate (sum of value) — preserves both severity and material magnitude without collapsing one into the other.
Composition law
The pipeline factorises cleanly as S = Φ ∘ Π ∘ Ω ∘ Σ — sample-statistical (Σ), oriented z-projection (Ω), inter-model aggregation (Π), and cohort-conditional banding (Φ). Each operator is pure, deterministic, and replayable. Re-running yesterday's data with today's pipeline returns yesterday's scores. Reproducibility is not a feature — it is a property of the algebra.
04 / Architecture
Edge-deployed. Workspace-isolated. PII-minimised by default.
Runtime
- · TanStack Start on Cloudflare Workers (global edge)
- · Postgres with row-level security; per-org isolation enforced at the DB
- · Scoring runs in-process — no third-party model calls, no data egress
- · Typical 100k-row dataset scored in 30s–2min
Data model
- · Minimum input: employee_id, date, hours, value, approver_id
- · No names, addresses, tax IDs or bank details required
- · Optional descriptive categories for recoding and segmentation
- · Append-only periods with duplicate detection across loads
Security
- · AES-256 at rest, TLS 1.3 in transit
- · Mandatory 2FA on every workspace
- · Per-workspace data retention policies, hard-delete on demand
- · Full audit trail: every read, write and export
- · DPA executed before data ingestion — not optional
Integration
- · CSV / XLSX upload — works with every payroll and HRIS export
- · No IT project, no connector build, no schema mapping work
- · Shared workspace model: invite audit, finance, integrity teams
- · PDF, DOCX and structured exports for downstream tooling
05 / Continuous assurance
Detection is the start. Surveillance is the system.
Once a claimant is flagged, MantaRay™ keeps them under structured surveillance. Cases carry exposure, primary risk type, suppression windows and a clearance register with full reinstatement audit trail.
Watchlist
Employee ID, risk band, risk type, total claim value, case status — one operational view.
Rapid verification
Cross-reference claimed hours against email activity, building access and timesheet sources for a per-claimant unsupported-hours figure.
Recover funds
Convert a verification into a formal overpayment notification — date range, per-day discrepancies and totals pre-filled. Letters never stored.
06 / Performance envelope
200MB
Single-file upload ceiling
CSV or XLSX, locale-aware parsing
100k rows
Scored in 30s–2min
End-to-end, all twelve models
5%–20%
Typical leakage uncovered
Against historical overtime spend
Get started
Run MantaRay™ against your own payroll data.
Spin up a workspace, upload an export, and see exactly where overtime is leaking — in minutes. No credit card. No IT project. No data egress.