System Constellation
HAIEC's evidence-bound AI action and access map. See how identities, permissions, AI actions, APIs, data and consequences connect — what your AI systems and agents can reach, what controls apply, and what the evidence actually establishes.
What a single path looks like
Five questions the map answers about your AI
The System Constellation connects the evidence that determines what an AI system or agent can reach, what it can change, and what happens when it acts. Every answer is backed by evidence, and gaps stay visible as unknowns rather than being filled in by assumption.
Which AI system, agent and identity?
Human identities, service accounts, API keys, OAuth scopes and machine credentials that establish who can request an action, and which agents or models sit in the request path.
What tools and actions can it reach?
The tools, functions, APIs and MCP servers the agent can invoke. Each tool is a potential action surface with its own access scope and consequence profile.
Which resources and consequences?
The data stores, services and records an action can touch, and the real-world outcomes it can trigger: a payment, a deployment, a message sent, a record modified.
What authority permits the choice?
Policy authorization, effective credential permission where qualified, and the delegated business choice are separate evidence planes. Permission is not delegation.
What does the evidence establish?
Each node and relation carries an evidence basis: static analysis, runtime observation, credential evidence or policy, each with its own coverage and limitations.
From connected evidence to a map you can act on
Connect evidence sources
HAIEC builds the Map from the evidence available for the evaluated system. Depending on the connected sources, that may include source analysis, policy, identity/access information, credential evidence, tool definitions, provider evidence, and runtime observations.
HAIEC builds the map
The Map joins supported evidence where correlation is established and preserves unresolved or missing relationships explicitly.
See what is established — and what is not
Each node and edge shows its evidence basis. Unknowns, partial coverage, and unobserved paths are visible, not hidden.
Assure within evaluated scope
HAIEC projects the relationships the evidence and evaluation support into the System Constellation, so you can inspect what was established — and what remains unknown. ALLOW means allowed within evaluated scope and available evidence — nothing more.
The Map is not a claim
It is an evidence-bound representation
- Permission is not delegation. Credential evidence establishes what the credential evidence supports.
- Static analysis shows what the code is capable of. Runtime observation shows what actually happened. They are different evidence types.
- Unknown is not PASS. Missing runtime evidence is not “did not happen.” The Map preserves these distinctions.
- Framework mapping is not certification. The Map supports assurance work — it does not replace professional judgment.
See the Map in action
Explore a sample System Constellation to see how identities, permissions, AI actions, APIs, data, and consequences connect — or scope an enterprise POC for your own systems.
A real evaluation snapshot with exact path identities and an explicit proof frontier.
Synthetic topology for exploration. Clearly labeled, never presented as a real evaluation.
Run HAIEC assurance from your AI agent or connect an eligible evidence source.