evidence path
repair / verified
proposed, not written
critical
How it works
FalkorDB isn't a picture here. Remove one edge and the same plan flips from PASS to BLOCK.
Identities, services, resources, credentials and invariants live in FalkorDB. Bounded Cypher reads return the exact multi-hop paths behind every decision.
Plans are projected in memory and checked against named invariants. The model proposes; code decides. The graph even suggests the repair.
A person approves. Each step is read back from the graph. A timeout is UNKNOWN, a half-done run is PARTIAL_FAILURE, never a fake rollback.