See how every number is produced before you trust one.
Discovery that never writes. A canonical fact layer with exactly one owner per metric. Engines that compute consequence rather than infer it. A significance layer that decides what deserves a human's attention. And a governance fabric wrapping every one of them.
This page walks the whole architecture in order. It is deliberately long — it exists so a conversation about how AuditGraph works can happen on a screen share instead of in a slide deck.
Five claims a security architect can check.
Five layers. Facts only travel up.
Facts flow up. Nothing flows down. A layer may only read from the layer beneath it, and no layer recomputes what a lower one already owns — which is why two screens cannot disagree without it being a defect.
No agent. No write scope. Nothing to approve twice.
Every identity across every class, with the authority each one holds. No agent is deployed, no code runs in your tenant, no custom role is created, and no write scope is ever requested.
What is read
Role assignments, scope strings, directory objects, app registrations, service principals, managed identities, federated identity credentials, PIM eligibility, conditional access policy, resource topology.
What is never read
The contents of your storage accounts, databases, or datasets. Classification is structural — by resource type, configuration, and labeling — not by inspecting data.
What is optional
Audit logs. They enrich activity signals where you have them, but nothing gates on them. Decline the scope and every conclusion on this page still computes.
Bands from measured counts and published thresholds — yours to override.
There is no proprietary 0–10 number. There are flags that fire on measured counts, with published defaults you can override per tenant. When you ask why something is flagged, the answer is an integer and a threshold.
Defaults shown. Every threshold is tenant-overridable — your definition of "wide reach" should be yours, and the product should not pretend its default is a law of nature.
The layer between true and worth your time.
Most security products have two layers: what is true, and what to do. Between them sits a third that usually has no owner — what deserves the executive's attention.
Ranking is by business consequence — exposure removed, attack paths closed, privilege authority. Never by how many identities are in a cohort. A big number is not an argument.
Condition
A business situation, computed from canonical facts. Carries its own evidence and band.
Finding
What the accountable reader is shown. One lead condition, ranked by consequence.
Decision
The one move, with projected outcome labeled as projected, and the evidence attached.
Every number tells you how it was arrived at.
Numbers on a security dashboard are usually indistinguishable: a measured count looks exactly like a vendor's estimate. AuditGraph makes the difference structural — every executive value is wrapped in an envelope that says how it was arrived at.
Ordered by honesty. A value with no basis does not render at all.
The four questions your reviewer will ask first.
Runs beside your IGA, CSPM and SIEM — and replaces none of them.
Scale, stated with a number.
Validated to a documented baseline of 100,000 identities and 950,000 role assignments. Beyond that, we size with you before onboarding rather than finding out together.
Find the reach you never granted.
A scoped assessment against your own Azure tenant. Read-only, agentless, and nothing is written to your environment — ever.
Free forever — 1 subscription, 500 identities · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available