Foundation

Your operational picture, kept live

People, devices, licences, groups, apps, tickets, and policies — one connected view fed from the systems you already run, so the Assistant knows who and what before it decides how.

Book a demo Explore product

Phase 2 · Q1

Capability 01

Entities from the systems you run

Users, identities, devices, licences, groups, apps, policies, tickets, documents, services, teams, roles — ingested from Okta, Workday, Jamf, Intune, GitHub, Salesforce, ServiceNow, and 60+ more sources. One entity per real-world thing, one snapshot cache per source system.

grounded answer · sources

answer

Priya’s Okta lockout can be cleared via self-serve MFA challenge — no IT intervention required. If MFA fails, escalate to IT on-call.

cited from

IT · Okta account lockout policy

runbook · updated 4d ago

HR · Emergency access procedure

policy · updated 2w ago

Ticket #48211 · priya · resolved

past ticket · similar match

Capability 02

Relations that answer real questions

owns · belongs to · member of · has access to · depends on · manages · escalates to · reports to. Traverse the graph to answer questions no ticket queue can: who owns X, who reports to the owner of Y, what breaks if Z's access is revoked, which incidents this quarter touched services owned by the finance team.

approvals · pending 4

unlock okta account

priya.sharma · self-serve · read-only

denyapprove

refund $128.40

stripe · ord_A4b2c · manager approval

denyapprove

revoke prod IAM role

aws · role/analyst · step-up MFA

denyapprove

reset zoom SSO

kiran.mehta · self-serve

denyapprove

Capability 03

Traceable to the source system

Every relation shows where it came from and when it was ingested. The audit trail includes the source-system row ID, so an operator can jump straight from a graph edge to the truth-of-record in Okta, Workday, or GitHub without a second search.

context · priya.sharma

Capability 04

Grounded to the second

Webhook-first refresh where the source supports it (Okta events, GitHub webhooks, Workday change feed). API-poll fallback for sources without push. Drift and error surface on the Sync page — if an integration goes silent, you see it before your reader does.

reports · this week

Auto-resolved

78.4%

+4.1 pt

Avg. loop time

11.4s

-2.1s

Approvals pending

-3

Coverage

94%

+1.2 pt

monsun

Capability 05

Explorer + Queries + Sync

Three surfaces on one graph. Explorer for point-and-click traversal — filter by entity kind, expand a node's edges, drill in. Queries for saved graph traversals your team runs weekly (access reviews, dependency reports). Sync for the health of the pipes.

grounded answer · sources

answer

Priya’s Okta lockout can be cleared via self-serve MFA challenge — no IT intervention required. If MFA fails, escalate to IT on-call.

cited from

IT · Okta account lockout policy

runbook · updated 4d ago

HR · Emergency access procedure

policy · updated 2w ago

Ticket #48211 · priya · resolved

past ticket · similar match

Capability 06

Time-scoped relations

Grants that expire, memberships with start dates, tickets with resolution timestamps — every edge can carry valid_from and valid_until. JIT access rides on this: a scoped role is granted with an auto-expiry edge, the Assistant sees it as active while it holds, and the revoke fires the moment it lapses.

approvals · pending 4

unlock okta account

priya.sharma · self-serve · read-only

denyapprove

refund $128.40

stripe · ord_A4b2c · manager approval

denyapprove

revoke prod IAM role

aws · role/analyst · step-up MFA

denyapprove

reset zoom SSO

kiran.mehta · self-serve

denyapprove

The BeforeQuery method

Visibility. Reasoning. Action.

Every playbook, every action, every answer follows the same three-beat rhythm — one that keeps every write behind evidence and every decision behind policy.

Visibility

Read the full context — who is asking, what they own, what they can access, what breaks if we touch it. Nothing acts on incomplete signal.

Reasoning

Match the request to a grounded answer or a playbook. Cite the source paragraph, weigh the risk tier, and route to the correct approver where policy demands it.

Action

Execute the write on your systems with an audit-log id, an entity list, and a rollback path. Confirm the outcome with the requester in the same thread.

How every request flows

From ask to resolution in one loop

Six stages every request travels. What changes is how many stages policy lets the agent execute without waiting on a human.

Request

In Slack, email, widget, MCP, or the helpdesk. Same voice, same context.

Slack · Teams · Zendesk · Widget · MCP

Retrieve

Grounded lookup against your knowledge with source paragraphs held aside.

Knowledge Studio

Reason

Read the Context Graph — who, what they own, what breaks if we touch it.

Context Graph

Approve

Route to the correct approver per policy. Reversible writes gated, destructive step-up.

Approval matrix

Execute

Act on Okta, Stripe, Workday, GitHub, or your own systems. Logged and attributable.

Actions runtime

Verify

Confirm the outcome with the requester. Feed the result back into future decisions.

Feedback loop

Request

In Slack, email, widget, MCP, or the helpdesk. Same voice, same context.

Slack · Teams · Zendesk · Widget · MCP

Retrieve

Grounded lookup against your knowledge with source paragraphs held aside.

Knowledge Studio

Reason

Read the Context Graph — who, what they own, what breaks if we touch it.

Context Graph

Approve

Route to the correct approver per policy. Reversible writes gated, destructive step-up.

Approval matrix

Execute

Act on Okta, Stripe, Workday, GitHub, or your own systems. Logged and attributable.

Actions runtime

Verify

Confirm the outcome with the requester. Feed the result back into future decisions.

Feedback loop

Enterprise-grade by default

The controls your security team is going to ask about

SOC 2 Type II

audited annually

GDPR

EU data residency

HIPAA-ready

BAA available

SSO / SAML

Okta · Entra · Google

SCIM 2.0

auto-provision

Audit log

every write, traceable

Bring your key

AES-256-GCM at rest

Bring your model

Anthropic · OpenAI · self-host

Zero training

your data stays yours

Rollback

every write reversible

TLS 1.3

in transit

99.9% uptime

SLA on Enterprise

Explore the stack

Works together with

Knowledge Studio

The documentary foundation, alongside.

Access Governance

The most obvious use of the Graph.

Asset Management

Devices and licences feed the Graph.

AI Service Desk

The queue that reads the Graph on every ticket.

Frequently asked questions

Common questions about Context Graph

Under the hood it's PostgreSQL — one table for entities, one for edges — with graph traversals expressed as recursive CTEs. That's fast enough for the queries a service desk needs, cheap to operate, and interoperates with the rest of our SQL. If your traversal patterns get expensive enough to justify it, we have an Apache AGE escape hatch on the same instance.

Cached, not copied. Entities hold a pointer to the source-system row plus a snapshot of the properties the Assistant needs to answer. The truth-of-record stays in Okta / Workday / GitHub; the cache expires on ingest error, and reads that miss the cache fall through to the source system directly.

Webhook-first, poll-fallback, per source. Okta events, Workday change feeds, GitHub webhooks, Salesforce push topics — each fires within seconds. Sources without a webhook API get polled on a source-specific cadence (Jamf every 5 min, Intune every 5, and so on). Drift and error surface on the Sync page.

Yes. Saved Queries expose graph traversals as clickable, shareable operator tools; the Assistant uses the same query surface internally. On Enterprise we expose a read-only SQL endpoint on the graph tables for downstream BI.

The Graph service, Explorer, Queries, Sync UI, and the Graph + Knowledge fusion in agent runs. Initial source coverage: Okta, Workday, BambooHR, HiBob, Rippling, Jamf, Intune, GitHub, Salesforce, Slack. Additional sources follow in Phase 3-4 as their integrations land.

Run foundation on BeforeQuery

Book a demo and see what Context Graph does on your own data — usually within 45 days.

Book a demo Start Free