The enterprise graph: an evidence-backed, time-aware model of your organisation

The graph is a model of the organisation: the things in it and the relationships between them. A person is an entity. So is a group, an account and an organisational unit. A person has accounts, belongs to groups and reports to another person. Those relationships are the edges, and they are the part that a spreadsheet or a document store cannot give you, because they are what answer questions such as who is responsible for this, and who can approve it.

It is customer-hosted. The appliance runs in your environment, in your virtual machine or your Kubernetes cluster or inside an air gap, and customer data stays there by default. It is continuously updating rather than a snapshot, so the picture follows the organisation as it changes.

It is the backbone that Cortex, Nexus, Studio and the Nexus harness are designed to read organisational context from. They ask the graph what an agent needs to know, and the agent acts only through typed, approved and audited capabilities. The wiring from those products into the graph is on the roadmap.

Each fact in the graph carries one of seven statuses: observed, corroborated, verified, inferred, stale, disputed or unknown. Observed means seen directly in a source. Corroborated means more than one independent source agrees. Verified means confirmed by an authoritative check or a person. Inferred means derived from other facts. Stale means not re-observed within its freshness window. Disputed means sources disagree. Unknown means there is no evidence either way.

The principle is evidence before inference. An answer that rests on a verified fact is a different kind of answer from one that rests on an inferred one, and the platform is built so that the difference is visible, to a person reading a view and to an agent reading context. A workflow can be told to rely on a verified owner and to ask a person otherwise.

Statuses also protect the organisation from false confidence. Disputed facts are surfaced as conflicts to resolve, not averaged away, and unknown is said plainly.

Because history is kept and never overwritten, the graph can answer questions about the past. Who was in this group last March? Who did this person report to when the decision was made? The read takes an as-of time and returns the graph as it stood.

This is the capability that makes the graph useful for review. A decision is reviewed against the organisation as it was at the time, and not as it is now, when the person has changed teams and the group has been renamed. It also supports investigation: when something went wrong, you can see exactly what the structure looked like and how it changed.

The graph also records the audit trail of the appliance itself in a hash-chained log, anchored by signed checkpoints, so that tampering with the record is detectable.

People in a real organisation have several accounts: one in the on-premises directory, one in the cloud directory, one in an identity provider, one in a workspace suite. A system that treats each account as a person will count the same human four times and miss that the four are one set of permissions.

The appliance resolves accounts across directories into a single person, and keeps the evidence for each link on the link itself. Reporting lines are derived at the person level as well as kept at the account level. The result is that a question about a person is a question about the person, whichever directory the answer came from.

Identity also matters to the other direction of travel. An AI acting on a user’s behalf is resolved to that user’s principals, and it is limited to what they may see. Content in the graph can carry access rules, and reads are filtered by them inside the database. Where the platform cannot establish who is asking, it fails closed and offers only what is tenant-wide.

The platform reports coverage as a measurement: which sources are connected, how fresh each one is, and how complete the picture is relative to what it is able to see. It is never worded as the platform understanding the organisation.

This is deliberately uncomfortable. A vendor that tells you its product understands everything about your organisation is asking you to stop checking. The graph tells you what it covers and what it does not, so you know when to trust an answer and when to ask a person.

Coverage is itself a view. It is part of how the platform helps you decide which collector to connect next.