NGT Exception Framework
Run controls, generate events, and turn them into explained exceptions. The framework that sits between a detected anomaly and the analyst who resolves it.
The NGT Exception Framework runs the controls, generates the events, and does the work between the event and the person. It is designed around one constraint: detection is cheap, but analyst attention is finite. A breach on its own is a weak signal: most of them are hedged classes, distributing classes or a model warming up. What an analyst needs is a point of attention that already carries its context: what breached, by how much and for how long, whether another analytics explains it, and what else happened to the share class and its sister classes around those dates.
How it works
An analytics writes its signals: one row per share class (or fee) and date, with a breach flag, bounds and a status. A rule runs over those rows. When its condition is met, it generates an event: the smallest unit in the system. Events that belong together, on one vehicle over a few days, are grouped into an exception, correlated with what the other analytics say about the same dates, and kept as a task: the thing an analyst is actually asked to open.
Two axes govern the path from event to exception:
- Axis 1: trigger methodology. Controls use statistical time series methods rather than fixed thresholds, so each event that fires is more likely to reflect a real anomaly.
- Axis 2: contextual events. High event volume is a feature. Contextual events explain anomalies before anyone looks at them, because they record what changed about the normal baseline that day.
Context informs, it does not dismiss: a performance fee breach on the same day as a NAV breach is shown on the exception as Additional Context, and changes nothing else about it.
In SPARK
The framework lives in three places in the app:
- Settings, under Analytics, Exception Framework: the Event Rules and Exceptions a workflow picks from, NGT's and your workspace's own. New adds one of your own, an Event rule or an Exception.
- Workflows: the framework runs in a workflow, as three steps. Generate Events turns signal rows into events, Generate Exceptions groups them into exceptions and keeps each as a task, and Explain Exceptions asks an agent to explain each task. See Exceptions for building the workflow step by step.
- Tasks: each exception is kept as a task, with its evidence on a canvas (see Exceptions are tasks).
Events
Events are saved in an Events data object (slug ngt_events), created from the Event template, version 2.0.2, in the template picker's Analytics group. Every analytics writes to the same object, so its columns are the ones they share:
| Column | What it holds |
|---|---|
| Event Type | The rule that fired, named by analytics, for example sce.nav_breach or pf.fee_breach |
| Event Category | breach, terms, model_quality, data_quality or information |
| Source Analytics | Which analytics raised it: share_class_evolution, performance_fees, fees_analytics, and so on |
| Description and Message | What this kind of event is about, and what happened on this date, for example NAV return -20.7 bp below its band |
| Entity Level, Share Class, Sub Fund | Which entity the event is about |
| Occurrence and Run Length | new, or continuing when the same rule fired on the same entity the previous NAV date, and for how many dates in a row |
| Details | The measured figures, as JSON |
| A link to the signal row | Share Class Evolution Signal, Performance Fees Signal or Fees Analytics Signal |
NGT's rules and exceptions
Rules and exception definitions are data, not code. NGT ships its own, and your workspace can add its own beside them, in Settings › Analytics › Exception Framework. NGT's are read-only; open one and duplicate it to start from a copy. A workflow step copies the ones it uses, so a threshold can be tuned without a release, and a run is reproducible from the workflow alone.
NGT's event rules:
| Rule | Fires when | Severity |
|---|---|---|
sce.nav_breach | A Share Class Evolution row is a breach, whatever the model's status | Fixed, 0.5 |
sce.return_deviation | The total return deviates from its peer-implied reference by more than 20 bp | From 0 at 0 bp to 1 at 100 bp and above |
pf.fee_breach | A Performance Fees accrual is outside the band the estimators agree on | 0.8 from 10 bp of NAV outside, 0.5 from 2 bp, else 0.25 |
NGT's exception, SCE Potential NAV Breach, raises an exception when, on the same date, a share class breaches its Share Class Evolution band and its total return deviates by 50 bp or more. A performance fee breach, or a fee charged off its stated terms, on the same day is its additional context.
Exceptions are tasks
Each exception is kept as a task titled EXCEPTION · followed by the exception's own title, for example EXCEPTION · GEO-A-EUR-ACC: NAV below its band on 23-24 Jul 2026. The first run adds the exception's fields to your Tasks (see Task fields): its reference, type and level, its share class and sub-fund, its window, trigger count and largest size in bp of NAV, a Summary of every event that made each date, its Additional Context, whether it is new or recurring, and the Previous Exception when it is.
The task links the exception's canvas, filtered to it through context variables (share class, sub-fund, window and a wider chart window), so its page shows the evidence. Once Explain Exceptions has run, an agent's Explanation (its likely cause, the evidence and next steps) shows under the task's description.
The task is where the exception is worked: status, assignees, priority, due date and comments are yours, and a rerun never overwrites them. A rerun updates the exception's own fields, clears an explanation that no longer fits a changed exception, and leaves a task whose exception is not raised again as it is. An exception that fires again after its window has ended is a new episode, with a new task, linked to the earlier one.
Pattern recognition
A case is a pattern. The framework compares that pattern against the history of the same vehicle (has this configuration occurred before, and what did it resolve to?) and across the universe of other vehicles at the same point in time (is this signature appearing on twenty funds simultaneously, pointing to an upstream cause?).
Similarity search across history and across the universe requires your data. No general model has the comparison set.
Agent access
The Exception Framework is an NGT Tool. An agent investigating a NAV movement starts where an experienced analyst would: with a case that already has correlated events, its context, and the canvas that shows them. Explain Exceptions gives each new exception an agent's first reading before anyone opens it, and from the task an analyst can carry on the investigation in a thread.
Agents own progress. People own decisions.
Further reading
- Build it in a workflow: Exceptions
- The full methodology, in the NGT insights article: NGT Tools: The Exception Framework