Track 01 Graph Hacks · Agents that act on connected data · FalkorDB

Agents propose.
The graph decides.

ActionGraph is a safety checkpoint for AI agent actions. Before anything runs, it checks the plan against a live FalkorDB graph and blocks changes that break things several hops away, with the exact path as proof.

Open the live demo → View the code

Checking the live graph…

agent: disable id-contractor-17, revoke credential BLOCK

100/100unsafe plans stopped

0/40safe plans falsely blocked

~13 mspreflight latency, p50

73tests in CI, against real FalkorDB

The problem

The request sounds safe.
The graph knows it isn't.

Agents act on one line of text. The damage is usually two or three hops away, in who owns what and what depends on it. A model can't reliably see that. A graph query can.

What the agent is asked

"Contractor 17 is leaving today. Disable their account and revoke their deploy credential."

id-contractor-17 -[OWNS]-> svc-billing -[DEPENDS_ON]-> db-billing-primary

What ActionGraph answers

BLOCK. Billing is critical and would be left with no eligible owner. The other name on it is a former employee who no longer counts. Nothing ran. Suggested repair: engineer-9 already runs payments on the same database.

How it works

Prove before act. Verify after act.

Every verdict is computed in code from the graph, not by a model. The model only proposes.

Propose

An agent, the web app or the CLI submits a plan: ordered actions such as assign owner, disable identity, revoke credential.

POST /v1/plans

Preflight on the graph

Bounded Cypher reads the live FalkorDB state. The plan is projected in memory and checked against named invariants, with the multi-hop path as evidence.

BLOCK NEEDS_REVIEW PASS

A person approves

Even a passing plan waits. The agent has no approve tool, so it can't approve its own plan. The graph is checked again right before the first write.

APPROVED

Execute and read back

Each step is read back from the graph. VERIFIED only if the read-back matches. A timeout is UNKNOWN; half done is PARTIAL_FAILURE.

VERIFIED

The AI agent

A real agent, kept on a short leash.

Type a request on the demo page. A Groq-hosted model plans with the same graph tools as the MCP server, gets blocked, reads the evidence, and revises until the graph says PASS.

4
Four tools, all read or proposelist_workspace, impact, propose_plan, get_plan_report.
✋
No approve, no executeThe plan is handed to a person in the inspector. Approval is a human act.
⇄
Also over MCPClaude Desktop or any MCP client gets seven tools, still with no approve tool.

live agent run · openai/gpt-oss-120b on Groq

› Contractor id-contractor-17 is leaving today. Disable their account and revoke their deploy credential.
list_workspace()  → 3 identities, 3 services, 2 resources
propose_plan(disable, revoke)  → BLOCK CRITICAL_SERVICE_WOULD_BE_ORPHANED
propose_plan(assign engineer-9, disable, revoke)  → NEEDS_REVIEW CREDENTIAL_SERVES_CRITICAL_RESOURCE
propose_plan(assign engineer-9, disable)  → PASS AWAITING_APPROVAL
✋ Ready for a person to review and approve.

Why a graph

Delete one edge. The verdict flips.

Same plan, same code. With engineer-9 -[OWNS]-> svc-billing in the graph, disabling the contractor passes. Delete only that edge and it's blocked. The graph is doing the work, not a prompt. It's a test in CI and step 5 of the demo.

PASS− 1 edge →BLOCK

Try it