Illustrative System
Production Incident Agent
See how an AI request can move through application access, credential evidence, tools, policy, and consequential actions. This synthetic example demonstrates the relationships HAIEC can represent when the relevant evidence is available.
Format:
Interactive React Flow diagram with lens/zoom controls and node inspector. If the diagram does not load, switch to the Text / HTML version.
Sample environment · illustrative data
This synthetic example demonstrates the relationships HAIEC can represent when the relevant evidence is available. It is not a customer scan, Assurance result, or claim that every source is automatically discovered.
Permission can be valid while delegation of the consequential choice remains unproven.
Permission is not delegation.
Scenario: Northstar Commerce Operations Copilot·Task: AI-assisted refund processing
HAIEC · ACTION ASSURANCE
Action to Consequence
Trace what AI can do, how authority and controls narrow it, what was actually evaluated, and exactly where the evidence ends.
System Constellation
SYNTHETIC HIGH-ACTION DEMOSOURCE-ESTABLISHEDPARTIAL / DERIVEDSOURCE GAP
Limitations
- Illustrative sample data: not evidence
- No runtime observation connected
- Delegation not established
- Credential evidence: limited
- Synthetic high-action scenario: demonstration values only
- …and 2 more
How to read this view
CTO questions this view should answer
- What untrusted data can influence the agent before a consequential action?
- What identity does the action execute under, and what is effectively granted versus policy authorized?
- Which consequence-resolving choices are still model-selected or unknown?
- Do synchronous, async, MCP, webhook and fallback paths cross equivalent controls?
- What can the system mutate, send, delete, authorize, schedule or execute?
- Which parts are source-proven, runtime-observed, policy-declared, partial, or unknown?
Truth semantics
established / directly evidenced
structural / partial / inferred
semantic / reference
Production edges need source Evidence, time basis, confidence and stable identity. A missing route-local guard is not automatically an unsecured endpoint.
High-value derived CTO insights
Residual discretion · policy-vs-code capability excess · effective overgrant · weakest-path control parity · late/audit-only controls · unbounded consequence dimensions · retry/idempotency multiplier · context trust gaps · topology change since evaluation · evidence blind spots · containment/witness limits.
Agent Effect Boundary · system: Northstar Commerce Operations Copilot (Sample)context → authority → action construction → mediation → consequenceauthorization ≠ confinementsolid = established/observed; dashed = partial/structural
Framework crosswalk (mapping only – not certification)
OWASP Agentic 2026 · ASI01 Goal HijackASI02 Tool MisuseASI03 Identity & Privilege AbuseASI04 Agentic Supply ChainASI05 Unexpected Code ExecutionASI06 Memory & Context PoisoningASI07 Inter-Agent CommunicationASI08 Cascading FailuresNIST AI RMF · GOVERN / MAP / MEASURE / MANAGESOC 2 crosswalk · Security / Availability / Processing Integrity / Confidentiality / PrivacyCrosswalk only – not certification
Accessible topology details
Sample environment · illustrative data
This synthetic example demonstrates the relationships HAIEC can represent when the relevant evidence is available. It is not a customer scan, Assurance result, or claim that every source is automatically discovered.
Permission can be valid while delegation of the consequential choice remains unproven.
Permission is not delegation.
Scenario: Northstar Commerce Operations Copilot·Task: AI-assisted refund processing
Limitations
- Illustrative sample data: not evidence
- No runtime observation connected
- Delegation not established
- Credential evidence: limited
- Synthetic high-action scenario: demonstration values only
- 3 review paths / 9 CODE_CAPABLE / 2 OBSERVED / 5 evidence gaps are demonstration values only
- REQUESTED means an explicit customer/operator declaration, not prompt or user input
Topology Nodes by Domain
Request(1)
User / application input
Entrypoint
IllustrativeAI-reachable: illustrative
Connections:
provides goalSystem instruction
Infrastructure(8)
RAG / knowledge base
Connected asset
IllustrativeAI-reachable: illustrative
⚠ data ≠ instruction
Connections:
feedsRepo / app instruction
Memory / agent state
Connected asset · PARTIAL
IllustrativeAI-reachable: illustrative
⚠ lineage currently partial
Connections:
informsTool schema / description
Tool / API output
Connected asset
IllustrativeAI-reachable: illustrative
⚠ can re-enter context
Connections:
enters contextInstruction merge / precedence
Peer agent / MCP
Connected asset · PARTIAL
IllustrativeAI-reachable: illustrative
⚠ trust + scope unresolved
Connections:
enters contextInstruction merge / precedence
Runtime override
Connected asset
IllustrativeAI-reachable: illustrative
⚠ prompt/model/tool/config
Connections:
runtime configEvaluated version binding
Provider / SDK
Connected asset
IllustrativeAI-reachable: illustrative
⚠ dependency ≠ runtime use
Connections:
dependencyRuntime config binding
MCP / tool package
Connected asset · PARTIAL
IllustrativeAI-reachable: illustrative
⚠ dynamic topology partial
Connections:
dynamic topologyRuntime config binding
Tool schema / description
Connected asset
IllustrativeAI-reachable: illustrative
⚠ availability ≠ entitlement
Connections:
availabilityTool router / selector
Credential(2)
Secrets / credentials
Provider IAM
IllustrativeAI-reachable: illustrative
⚠ effective reach
Connections:
effective reachOptimizer / rewrite
EFFECTIVELY_GRANTED
Provider IAM · synthetic PARTIAL
IllustrativeAI-reachable: illustrative
⚠ synthetic PARTIAL
⚠ source required in production
Connections:
synthetic PARTIALapi.stripe.com
Policy(11)
System instruction
Policy
Illustrative
⚠ policy intent
Connections:
policy intentModel call
Repo / app instruction
Policy
Illustrative
⚠ local constraints
Connections:
local constraintsPlanner / agent loop
POLICY_AUTHORIZED · Approved Operating Envelope
Approved operating envelope
Illustrative
⚠ tools · scope · destinations · bounds
Connections:
approved envelopeRefund amount
Authentication
Policy
Illustrative
⚠ ✓ Authentication
Connections:
✓ AuthenticationCanonical path
Tenant scope
Policy
Illustrative
⚠ ✓ Tenant scope
Connections:
✓ Tenant scopeCanonical path
Resource authorization
Policy
Illustrative
⚠ ✓ Resource authorization
Connections:
✓ Resource authorizationCanonical path
Approved tool
Policy
Illustrative
⚠ ✓ Approved tool
Connections:
✓ Approved toolCanonical path
Schema / type validation
Policy
Illustrative
⚠ ✓ Schema / type validation
Connections:
✓ Schema / type validationCanonical path
Effect bounds mismatch
Policy
Illustrative
⚠ ! Effect bounds mismatch
Connections:
! Effect bounds mismatchAsync worker path
Approval not established
Policy
Illustrative
⚠ ! Approval not established
Connections:
! Approval not establishedDirect tool / MCP
Rate · retry · idempotency
Policy
Illustrative
⚠ Rate · retry · idempotency
Connections:
Rate · retry · idempotencyAsync worker path
AI Agent(6)
Instruction merge / precedence
AI execution
IllustrativeAI-reachable: illustrative
⚠ trusted + untrusted sources
Connections:
trusted + untrustedAction constructor
Optimizer / rewrite
AI execution
IllustrativeAI-reachable: illustrative
⚠ only if discovered
Connections:
rewriteModel call
Model call
AI execution
IllustrativeAI-reachable: illustrative
⚠ provider + model + tools
Connections:
provider + model + toolsstripe.refunds.create
Planner / agent loop
AI execution
IllustrativeAI-reachable: illustrative
⚠ only when source-proven
Connections:
source-provenPaymentIntent target
Tool router / selector
AI execution
IllustrativeAI-reachable: illustrative
⚠ available vs approved
Connections:
available vs approvedRefund amount
Action constructor
AI execution
IllustrativeAI-reachable: illustrative
⚠ tool + arguments
Connections:
tool + argumentsstripe.refunds.create
Evidence(9)
Evaluated version binding
Evidence · ESTABLISHED
Illustrative
⚠ scope + build/deployment
Connections:
scope + buildExecution identity
Runtime config binding
Evidence · PARTIAL
Illustrative
⚠ current vs evaluated
Connections:
current vs evaluatedEFFECTIVELY_GRANTED
AI Inventory + Connected Assets
Evidence
Illustrative
⚠ current topology anchors
Connections:
feedsStatic IR + Flow analysis
Static IR + Flow analysis
Evidence
Illustrative
⚠ entrypoints · prompts · sinks · auth
Connections:
feedsCapability / Action Surface
Capability / Action Surface
Evidence
Illustrative
⚠ what software can do
Connections:
feedsEvaluated Scope
Evaluated Scope
Evidence
Illustrative
⚠ what was actually evaluated
Connections:
feedsEvidence Projection & Diagnostic Pipeline
Evidence Projection & Diagnostic Pipeline
Evidence
Illustrative
⚠ exact-run evidence + coverage
Connections:
feedsAssurance Decision Engine
Assurance Decision Engine
Evidence · CANONICAL
Illustrative
⚠ sole decision authority
Connections:
emitsPackage & Receipt Service
Package & Receipt Service
Evidence
Illustrative
⚠ verifiable decision integrity
Identity(3)
Execution identity
Identity · PER-ACTION PARTIAL
IllustrativeAI-reachable: illustrative
⚠ who the system acts as
Connections:
who the system acts asorg_demo_8472
Delegated discretion
Identity · NOT GENERALLY ESTABLISHED
IllustrativeAI-reachable: illustrative
⚠ permission ≠ delegation
Connections:
permission ≠ delegationstripe.refunds.create
org_demo_8472
Identity · BOUND
IllustrativeAI-reachable: illustrative
⚠ tenant scope · server-bound
Connections:
tenant scopeResource authorization
Action(9)
stripe.refunds.create
Action · CODE_CAPABLE
IllustrativeAI-reachable: illustrative
⚠ FINANCIAL_MUTATION
⚠ AI-reachable
⚠ Delegation not established
⚠ No runtime observation connected
Connections:
FINANCIAL_MUTATIONAuthentication
boundsEffect bounds mismatch
approvalApproval not established
PaymentIntent target
Action
IllustrativeAI-reachable: illustrative
⚠ symbolic target · server-resolved ID
Connections:
server-resolvedTenant scope
Refund amount
Action · POLICY/CODE MISMATCH
IllustrativeAI-reachable: illustrative
⚠ policy ≤ $2,500
⚠ code capable ≤ $10,000
⚠ Delegation not established
Connections:
policy ≤ $2,500Approved tool
api.stripe.com
Action
IllustrativeAI-reachable: illustrative
⚠ approved external payment destination
Connections:
approved destinationSchema / type validation
rateRate · retry · idempotency
Canonical path
Action · canonical path · stronger controls
IllustrativeAI-reachable: illustrative
⚠ POST /refund → BillingService
Connections:
producesDatabase write
producesStripe refund
could result inRole / permission / IAM
Async worker path
Action · PARTIAL
IllustrativeAI-reachable: illustrative
⚠ refund.queue → worker
⚠ retry + idempotency parity partial
Connections:
could result inDatabase write
could result inStripe refund
Direct tool / MCP
Action · PARTIAL
IllustrativeAI-reachable: illustrative
⚠ Tool / MCP
⚠ canonical guard bypass?
Connections:
could result inStripe refund
Webhook / callback
Action
IllustrativeAI-reachable: illustrative
⚠ Webhook / callback
⚠ provider auth + tenant attribution
Connections:
could result inEmail / Slack / HTTP
Fallback / flag / legacy
Action · PARTIAL
IllustrativeAI-reachable: illustrative
⚠ Fallback / flag / legacy
⚠ weaker topology?
Connections:
could result inCode / CI / cloud change
could result inKill-switch domain
Consequence(6)
Database write
Potential consequence
IllustrativeAI-reachable: not established
⚠ tenant-sensitive mutation
⚠ Consequence not established: no runtime observation connected
Connections:
tapAI Inventory + Connected Assets
Stripe refund
Potential consequence · REVIEW
IllustrativeAI-reachable: not established
⚠ external financial mutation
⚠ Consequence not established: no runtime observation connected
Connections:
tapStatic IR + Flow analysis
tapPackage & Receipt Service
Email / Slack / HTTP
Potential consequence
IllustrativeAI-reachable: not established
⚠ data leaves boundary
⚠ Consequence not established: no runtime observation connected
Connections:
tapCapability / Action Surface
Role / permission / IAM
Potential consequence
IllustrativeAI-reachable: not established
⚠ authority expansion
⚠ Consequence not established: no runtime observation connected
Connections:
tapEvaluated Scope
Code / CI / cloud change
Potential consequence
IllustrativeAI-reachable: not established
⚠ operational mutation
⚠ Consequence not established: no runtime observation connected
Connections:
tapEvidence Projection & Diagnostic Pipeline
Kill-switch domain
Potential consequence · PARTIAL
IllustrativeAI-reachable: not established
⚠ generalized agent integration not established
⚠ Consequence not established: no runtime observation connected
Connections:
tapAssurance Decision Engine
Relationship Legend
Color indicates the kind of relationship between nodes.
reaches
guarded by
routes to
can reach
connected to
uses credential
governed by
uses tool
implements
handles
reaches resource
accesses shared resource
potential channel
has persistence
deferred to
evaluation exposure
credential reference
unknown / not AI-reachable
Evidence Basis Legend
Line style indicates how strongly a relationship is established. This is separate from the relationship type shown by color.
Source-established – Relationship established from deterministic source evidence.
Structural / inferred – Relationship inferred from structural analysis, not directly observed.
Potential / referential – Potential or referential relationship. Not established as fact.
Illustrative Five-Plane Evidence Questions
Every AI action has five evidence planes. This sample shows which planes are illustratively established.
RequestedIllustratively established
Policy authorizedIllustratively established
Credential evidenceLimited
Code capableIllustratively established
ObservedNo runtime observation connected