Overview#
Serious investigations run on competing theories. Money came from account A or account B. The subject was at the scene or the timeline collapses. A partner agency believes a third network is involved. When those hypotheses live in personal notebooks, encrypted chat side channels, or slide decks emailed after the meeting, the lead agency loses the thread and supervisors cannot see what the team currently believes. Cross-border and multi-agency task forces feel that pain first.
The Investigative Partner Hypotheses Workspace stores analyst working theories inside the investigation. Teams reopen the same workspace later, adjust hypotheses as evidence arrives, and keep partner collaborators aligned on the live set of ideas under test. Persistence is durable across sessions and devices. Access remains inside existing investigation controls; the workspace is not a bypass around case ACLs. Graph and evidence tools stay one step away so a hypothesis can be tested against entities and material already on the case.
For financial intelligence units, major crime teams, and partner-enabled programmes evaluating Argus, this module is how "working theory" becomes an operational object rather than folklore.
Last Reviewed: 2026-09-15 Last Updated: 2026-09-15
Key Features#
-
Durable workspace state: Hypotheses survive sign-out and device changes. Reloading the investigation restores the last saved workspace.
-
Investigation attachment: Each hypothesis set belongs to an investigation. Switching cases loads the matching workspace.
-
Partner-ready collaboration: Partner-aware flows can read the same hypothesis list the lead agency uses, subject to investigation access controls.
-
Lifecycle of ideas: Analysts update or retire hypotheses as evidence arrives instead of appending endless unstructured notes.
-
Graph and evidence adjacency: From a hypothesis, analysts move into related entities and evidence already linked on the case.
-
Supervisory visibility: Case supervisors can scan active hypotheses before allocating another analyst day or briefing command.
-
Audit-friendly persistence: Storing hypotheses in platform persistence keeps them inside backup, retention, and eDiscovery stories the organisation already runs for investigations.
Use Cases#
-
Long-running financial inquiry: Analysts park competing source-of-funds theories and revisit them as bank and blockchain data arrives.
-
Cross-agency task force: A partner liaison opens the investigation and sees the current hypothesis list without waiting for an emailed briefing pack.
-
Major crime command reviews: Senior investigators scan active theories before press lines or operational actions are approved.
-
Handover between shifts: Night team leaves structured hypotheses for the day team rather than a wall of chat screenshots.
Integration#
Investigation backend persistence in argus_middleware stores workspace payloads against the investigation record (including investigative-partner hypothesis persistence). fe2 investigation UI hosts the workspace. Graph analysis and evidence modules provide the test-against-reality path. Collaboration features can reference the hypothesis under discussion. auth_service and investigation ACLs enforce who can read or edit.
Open Standards#
- STIX 2.1 Opinion and Note objects: Hypotheses can be exported alongside intelligence packages using STIX constructs for analyst commentary.
- NIEM investigation packages: Investigation identifiers remain consistent with NIEM-aligned case exchange used elsewhere in Argus.
- ISO 27037-oriented evidence handling: Linking hypotheses to evidence objects keeps analytical claims tied to material handled under forensic process.