AIState · the product

Three layers, one architecture. Your estate, your encoded knowledge, your controls.

Three layers, one platform. 01 · the Knowledge Fabric resolves the estate in place. 02 · the Knowledge & Agentic Studio is where your people encode what they know — as agencies, chains and agentic widgets — to work on it under review. 03 · governed utilities are what the work looks like — the graph, cases and evidence, monitoring and reporting. Governance and your own infrastructure sit beneath all three.

01 · Knowledge Fabric

Read in place. Resolved into one knowledge graph.

A scheduled sync reads every asset in the platform and in the systems it is connected to, samples schemas, draws lineage, runs quality checks and snapshots the trend — nothing is catalogued by hand, and no rows leave those systems to build it. What those systems hold is then resolved into one knowledge graph: not a flat inventory of tables and columns but multi-dimensional objects carrying their relationships — explicit and inferred — each with its basis. Every screen reads from it. Identifiers, folded names and transliteration resolve the same person across systems into one graph; the rest is queued for a person.

Assetsworkspaces, investigations, entity types, live sources, imports, evidence containers, the search index, every connector

Lineagesource streams graph · import loads investigation · connector enriches subject · evidence extracted to import

Qualitybuilt-in checks plus your own read-only checks; incidents with owners; a stale feed declared until it returns

Connectionsread-only enterprise tools over named connections, a built-in investigation hub, and a catalogue of external servers to register

Modelyour schema in the Schema Builder; any LLM inside the data boundary you set

How the Fabric works, screen by screen → · ▶ The IT-team walk-through

Fabric explorer — **Explorer.** Every asset with its sampled schema, owner, tier, domain.

Fabric lineage — **Lineage.** Multi-hop, discovered, de-duplicated.

Fabric quality checks and when they last ran — **Quality.** Checks on the sync, incidents with owners.

MCP hub — **Hub.** Investigation tools hosted in-process, keys server-side.

AGENCY RUN · EXECUTION TRACE

Every run shows its work. Context → model → tools → graph, each hop timed on the server clock.

System agencies dock — **System agencies.** Scheduled and event-driven; findings in a dock, never silent effects.

Agency result with a diagram — **Graphics as answers.** Diagrams, networks, flows — filed as exhibits in one click.

Agency library editor — **Configuration, not code.** Enable, edit, reset, create.

02 · Knowledge & Agentic Studio

You do not build software. You encode what your people know.

A bench of 105 agencies that already know the work — enrichment, risk, financial crime, cyber, OSINT, legal process, case operations, reporting — each with its own remit, the context it may read and the short list of things it is allowed to change. The Studio is where your own people add theirs: agencies that do one job well, chains that link them with conditions, parallel steps and approval steps, and agentic widgets that answer in place with a diagram, a table, a map or a live screen. Written in words, tested against a real target, then published.

Proposalswhen the process runs at a propose-only autonomy level, or a change needs a decision you reserve, it appears as a proposal on the canvas and in the review queue, and stays out of reports until accepted

System agenciesa standing set review, validate, monitor and support intelligence across every workspace — hourly, daily, or on case created / subject linked / evidence added / alert

Traceledger, topology, DAG and waterfall of model calls, tool calls, tokens, bytes and writes — kept with the result

Toolsgraph and case-file tools, the MCP hub, external connectors, other agencies; capped and filtered per run; a classification ceiling withholds connectors from cases above it

The Context-Aware Dialogone conversation bound to the record you are on; every action in the platform's own API, permission-gated; answers as live widgets and embedded screens

What an agency actually is → · ▶ The Studio, end to end (9:14) · Agencies in the feature guide →

03 · Governed utilities — the graph, cases and monitoring

One engine for investigations and live monitoring.

Investigation graphs render while they load, and positions persisted so a reload opens settled. Live graphs take streams, webhooks, MCP pushes and imports through visual pipelines and a recency window opens the latest slice and retention prunes inside your boundary, new events animate only their neighbourhood.

Analysiscommunity detection with hulls, degree · betweenness · PageRank · closeness, shortest paths, combos, lens, bundling, timeline, map, 3D

Importscall records, bank returns, phone extractions, chat exports, network / access / mail / forensic logs — entities, aggregated edges, and the source records held as case evidence under your key — hashed, not a second copy of the system they came from

Pipelinessource → transform → filter · route · map · alert · sample · rate-limit · dedupe → graph; server-side, so a filter keeps data out

Sourcesingress tokens, webhooks with mappings, MCP pushes, SSE / NDJSON / WebSocket / polling feeds, simulators, file imports at a replay rate

Search⌘K over every index at once; the dialog highlights, selects and zooms the canvas by name

The canvas → · Live capture →

Communities drawn on an investigation graph — **Communities and centrality.** Hulls separate the groups; size shows what the network runs through.

LIVE CAPTURE · SOURCE → PIPELINE → GRAPH

Live capture. Sources, pipeline, HUD and analysis bar.

Betweenness centrality — **Centrality.** Nodes sized and coloured; the rankings panel lists the top entities.

3D investigation — **3D.** Same forces with a z axis; orbit, depth, fog.

03 · Fed by reality

The records an investigation actually runs on — read as evidence, kept as rows.

Call detail records, bank returns, device extractions, chat exports and cyber logs are imported with the profile and column mapping detected for you, dry-run first, merged into the graph as entities and aggregated relationships — and kept, row by row, so the analysis is on the records themselves rather than a summary of them. One click undoes an import.

Commstop numbers and pairs, hour-of-day and weekday patterns, talk time, night activity, common contacts between two handsets

Moneyper-account in / out / net, counterparties, monthly series, structuring, round-amount and pass-through flags

Movementcell-site tracks, dwell, co-location, who-was-there — from the cell ids already in the records

Registersindicators with kill chain and ATT&CK; every value the platform reads checked against them and recorded as a sighting; statutory notices, RFIs and seized assets keep their own registers

Records & analytics → · Indicators, watches & sightings →

Case overview — **The case file.** Number, type, priority, status, classification, handling; squad, subjects, approvals.

Case evidence — **Every exhibit carries its proof.** sha256, encryption, seal, hold, custody, extraction, capture provenance.

Attribute provenance — **Where every attribute came from.** Connector, tool, citation, link, confidence, who, when.

A workflow paused for a supervisor’s approval — **Workflow.** Standard notation, approvals with deadlines, named transitions with reasons.

03 · Cases & evidence

Work that has to stand up later.

Subjects with roles, evidence with chain of custody, regulatory reports with derived deadlines, tasks, recoveries and holds, restricted sources, indicators, registers, whiteboards, meetings and email — one case file, every mutation an audit entry hash-chained to the last, reads included.

Evidenceoriginals immutable, encrypted at rest, re-hashed on every download; sealing, legal hold, redaction, retention, evidence packs with a privilege log

Documentsa dedicated screen per exhibit — pages, highlights and drawings on the original, four AI readings with citations, chat, compare, versions

Subjectsprofiles, duplicate detection and merge, background checks across seven sections, enrichment agencies per type, provenance on every value

ProcessBPMN workflows, two-person approvals, statutory notice register, conflicts of interest, deadlines rolled up to the workspace

Cases in the feature guide → · ▶ A case worked start to finish

Lifecycle cost

Lower cost across the whole life of the platform.

Each stage against market-standard cost.

Bring it in
40–50% lower
Weeks, not quarters — read in place, with no migration programme.
Build and extract
75–85% lower
Your people and your partner compose it. No standing team of vendor engineers.
Run it
45–65% lower
Depending on volume — the agencies carry the work, people take the decisions.
Leave it
90% lower
Systems of record were never touched. Export the identity layer, policy, decisions and audit trail.

Illustrative. Run reduction varies with volume; every figure is validated against your own estate in the proof of value.

Beneath everything

Governance is not a policy document. It is the architecture.

Permissions, not roles

Every capability a named permission; custom roles on a base ladder; clearance and case grants gate every record; a restricted case is a 404 to everyone else.

Approval where you reserve it

Agencies act within policy. Where you reserve a decision, they propose, and a reviewer accepts or rolls back; closing, unsealing, disclosure and asset decisions need a second person; every decision carries a name and a basis.

Data boundary

Every model provider is located — commercial, government, on-premises — and a feature can only be served inside the boundary you configure.

Evidence integrity

Hash-chained audit anchored daily, immutable originals, encryption at rest, integrity verified on every download.

Identity

MFA, SSO for Google, Microsoft Entra, Okta and generic OIDC, claim mappings, scoped API keys, session lock, access review, security events.

Accreditation evidence

The NIST 800-53 control baseline assessed against your deployment on every load, with the actions that close each gap and a package a reviewer can take away.

Every setting and control →For the IT team

Three layers, one architecture. Your estate, your encoded knowledge, your controls.

Knowledge Fabric

Knowledge & Agentic Studio

Governed utilities

Governance & your infrastructure