A platform, all the way down.
Discovery that never writes. A canonical fact layer with exactly one owner per metric. Engines that compute consequence rather than infer it. A significance layer that decides what deserves a human's attention. And a governance fabric wrapping every one of them.
This page walks the whole architecture in order. It is deliberately long — it exists so a conversation about how AuditGraph works can happen on a screen share instead of in a slide deck.
Five layers, one direction of travel.
Facts flow up. Nothing flows down. A layer may only read from the layer beneath it, and no layer recomputes what a lower one already owns — which is why two screens cannot disagree without it being a defect.
The governance fabric wraps every layer
Discovery reads. It never writes.
Every identity across every class, with the authority each one holds. No agent is deployed, no code runs in your tenant, no custom role is created, and no write scope is ever requested.
- Connect Read-only consent, reviewed in your portal
- Enumerate Identities across all six categories
- Resolve Scopes, groups, PIM, federation
- Classify Resource types and data trust zones
- Graph Edges with attribution
- Snapshot Point-in-time, comparable
What is read
Role assignments, scope strings, directory objects, app registrations, service principals, managed identities, federated identity credentials, PIM eligibility, conditional access policy, resource topology.
What is never read
The contents of your storage accounts, databases, or datasets. Classification is structural — by resource type, configuration, and labeling — not by inspecting data.
What is optional
Audit logs. They enrich activity signals where you have them, but nothing gates on them. Decline the scope and every conclusion on this page still computes.
One metric. One owner.
Every canonical metric is registered to exactly one producer. The registry is the contract: it names the metric, its owner, its unit, and its basis. If a second piece of code computes the same number, that is a build failure, not a design choice.
This is the boring architectural discipline that makes the interesting claims possible. When an auditor asks why the executive summary and the compliance pack show the same figure, the answer is that they are literally the same value, read from the same view.
A value that cannot fill every row does not render. Not as zero, not as a dash — it renders as unknown, which is a different and honest thing.
- Fact views Canonical storage
- Engines Computation, not storage
- Registry The authority contract
- Producers Namespaced API
- Reconcile Continuous audit
- Certify Regression guard
Authority cascades. So must the graph.
An assignment names one scope. It grants everything beneath it. Resolving that hierarchy correctly is the difference between a picture that reassures and a picture that is true.
Every edge is attributed
Direct assignment · group membership · nested group · inherited scope · federated trust · PIM-eligible activation. An edge we cannot attribute is an edge we do not draw.
Eligibility counts
A PIM-eligible role that is not currently active is still reach — it is one activation away. Treating it as zero is how standing privilege hides.
From one credential to the consequence.
Blast radius is computed before exploitation, from configuration. It answers what a compromise of this identity would reach — not what it did last week.
- Identity Human, NHI, or AI agent
- Assignments Every role it holds
- Scope resolve Cascade down the hierarchy
- Reach set Resources actually reachable
- Classify PHI · PCI · PII zones
- Consequence What the business would lose
Bands from measured facts, not a score.
There is no proprietary 0–10 number. There are flags that fire on measured counts, with published defaults you can override per tenant. When you ask why something is flagged, the answer is an integer and a threshold.
| Risk flag | Fires when | Severity escalation |
|---|---|---|
| broad_blast_radius | Identity can reach ≥ 50 resources | Escalates at ≥ 100 |
| privileged_wide_reach | Privileged role across ≥ 3 subscriptions | Escalates at ≥ 5 |
| ai_excessive_blast | AI agent identity reaching ≥ 20 resources | — |
| dormant_high_blast | Dormant identity still reaching ≥ 10 resources | Escalates at ≥ 30 |
Defaults shown. Every threshold is tenant-overridable — your definition of "wide reach" should be yours, and the product should not pretend its default is a law of nature.
- Human Employee, admin, contractor
- Service Principal App registration
- Managed Identity System or user-assigned
- AI Agent A subtype of NHI
- Model Cognitive Services
- Classified Data PHI · PCI · PII
The rung that nobody else has.
Most security products have two layers: what is true, and what to do. Between them sits a third that usually has no owner — what deserves the executive's attention.
AuditGraph gives that responsibility a layer, an engine, an object with a lifecycle, and a ranking criterion. A Condition is a business situation the estate is in. A Finding is a condition that has crossed the bar for someone's attention.
Ranking is by business consequence — exposure removed, attack paths closed, privilege authority. Never by how many identities are in a cohort. A big number is not an argument.
A business situation, computed from canonical facts. Carries its own evidence and band.
What the accountable reader is shown. One lead condition, ranked by consequence.
The one move, with projected outcome labeled as projected, and the evidence attached.
Every value carries its own basis.
Numbers on a security dashboard are usually indistinguishable: a measured count looks exactly like a vendor's estimate. AuditGraph makes the difference structural — every executive value is wrapped in an envelope that says how it was arrived at.
Ordered by honesty. A value with no basis does not render at all.
Constraints, not features.
These wrap every layer. They are the reason the product cannot produce a confident wrong answer even when it would be commercially convenient.
Unknown is never green
Absence is not safety. A gap in visibility is rendered as a gap — never coerced to zero, never defaulted to healthy, never quietly excluded from a denominator to improve a percentage.
Deterministic by construction
No language model sits in any reasoning, ranking, or narration path. Argus formats what the engines concluded. The same estate produces the same answer twice — a property you cannot get from a generative pipeline.
Fail-closed tenant isolation
Every tenant-scoped table is protected by row-level security in the database. Isolation does not depend on application code remembering to add a filter.
Continuous reconciliation
A harness re-derives canonical values and compares them against what the surfaces render. Drift between the two is a failing test, not a support ticket someone files later.
Fits where you already are.
Scale, stated with a number.
Validated to a documented baseline of 100,000 identities and 950,000 role assignments. Beyond that, we size with you before onboarding rather than finding out together.
Walk it against your own estate.
This page is the architecture in the abstract. The assessment is the same walkthrough with your tenant's numbers in it.
Free forever on a bounded estate · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available