AI Graph

The AI Graph (Workforce → AI Graph) is the dependency map of your AI workforce for the workspace, environment and time range you choose in the top bar. It answers three questions in order: what is wrong now, what it affects, and what to do about it. It is part of Pro, Business and Enterprise, and of the trial.

Reading the map#

Every node sits in a fixed lane, left to right: Teams, Workflows, Agents, Models and tools, then Providers, MCP servers and data sources. Relations point from what depends to what it depends on: a workflow runs agents, an agent calls models and uses tools, a model is served by a provider, a tool reads a data source or is served by an MCP server. Teams own agents, workflows, models, tools and data sources, and a model can fall back to other models.

The map combines what you declared in the registry (owners, allowlists, workflow chains, fallback models, MCP servers) with the relations your telemetry shows over the last 30 days. By default the time range never changes what is drawn, only how it looks: a relation with no traffic in the range is dashed. A call through the MCP gateway is drawn as a tool served by its MCP server, never as a data source.

• Show picks what the map composes: everything, problems and what they affect, what was active in the range, what is declared in the registry, governance gaps, or declarations unused for 7 days.
• Colour by health (the default), traffic, cost or ownership.
• Filters narrow by node type and by state, open incidents, pauses, unregistered entities, production, critical workflows and recent changes.
• Map | Table shows the same nodes and relations as two sortable tables, which is also how the map reads with a screen reader.
• Fit the map (bottom right) shows the whole map. On narrower screens the minimap starts hidden: turn it on with its button there or under Legend.

The structure is rebuilt every 5 minutes, after every registry change, and on demand with Refresh structure (registry:write or ops:execute). Owners, admins, operators and developers can use the button; other roles see who can. A relation seen in the last 24 hours that is not built yet is drawn as new since the last structure build. When you choose an environment in the top bar, only the numbers are filtered: a card without traffic there says No traffic in Production. Maps above 250 nodes show problems first and group the rest; the page says so and offers Show everything. A link to a node that is not on the map says why: another workspace (with Switch to it), registered after the latest structure build (Refresh structure), retired (a retired agent, workflow or data source is no longer drawn, and no refresh brings it back), or not known to the map.

Health: what is failing now#

A node’s colour comes from your organization’s own detector rules, each over its own window, with the thresholds and overrides set in Operations → Detectors:

A call that timed out or ran past the timeout rule marks the node Slow. Below the failing line a node can be Degraded; with too few calls for the rule it still shows its failures, with the counts and small sample. Calls your policies or a pause refused never count as traffic or failures (a node with only refused calls reads Refused only). Without telemetry the state is Unknown, never healthy. Every state is a border colour, a glyph and a word, and each node’s details give the sentence behind it.

For a range that ended in the past, nodes are judged by their worst bucket in it: 15 minutes for ranges up to 6 hours, an hour up to 7 days, a day beyond. The numbers on the cards (requests, failure share, latency, cost) are totals for the range and stay context: they never colour a node. Latency percentiles are estimates (marked ≈) and cover ranges up to 30 days; data sources and MCP servers count the last 24 hours of the range.

Needs attention#

With nothing selected, the panel beside the map lists what needs attention: Problems now, then Watch and Hygiene. Each problem is one row, grouped by its root: its open incidents with the step of their journey, what it affects, and one next step, the journey’s waiting action or a control. A row never claims a cause: when failures happen together it says so with the numbers (for example how many failed calls read the same data source) and leaves the cause to you.

Watch also lists statistical signals of the last hour, such as an error spike against the previous 7 days or a traffic drop against the same time of day on each of them. Each shows its numbers, its baseline and the test it passed, is labelled statistical signal, not an incident, and never opens an incident. A pause explains the silence it causes: a paused agent or workflow, and what only it calls, raises no signal for the calls it no longer makes. Two cases still raise signals, because hourly totals cannot tell why calls stopped: with all workspaces shown, an agent or workflow registered in several workspaces counts as paused only while it is paused, stopped or retired in every one of them; and when a workflow’s runs stop at a paused agent’s step, the agents that would have run after it can show their own drop or silence.

What depends on what#

• Dependency health: a node’s details say what it depends on that is failing or slow now, or has a critical or high incident open (for example Depends on lookup_order, failing now), without claiming a cause.
• Dependency impact (the node’s details, or the key i): what depends on a node, upstream by default, with the runs that touched it in the last 24 hours measured from your spans, production and critical workflows marked, and the owner teams.
• Incident overlay: Open in AI Graph on an incident opens the map in the incident’s window with its root, what it reached (for example 21 of 52 runs failed), the owner teams and the journey’s next step. When the failed calls share a data source, it says so with the numbers (for example 68 of 72 failed lookup_order calls read orders-db). Potential reach adds what depends on the root structurally, marked at risk, no failures measured. The incident’s blast radius is the measured part.
• Trace path: Show this run’s path on a trace numbers the relations one run used and marks the call where its failure started.
• Compare shows what changed against the previous range of the same length: new and vanished relations, and the changes in calls, failures, latency and cost.
• Live refreshes the state every 15 seconds and marks relations with calls in the last minute.

Acting from the map#

Every control on the map uses the same governed path as the rest of the console: your role’s permission, your plan, the feature flags, the action’s risk, four‑eyes approval where it applies, and an audit event. Before a pause, resume, model switch or limit raise is requested, the server previews it: its risk, whether a second person must approve it, the incident it will be linked to, and what Worksi will verify afterwards. The toast reports what the server did, never the preview. Pausing an agent or workflow first shows what the pause would stop (its last 24 hours of calls and runs and the workflows it runs in). The dialog asks which incident to link when several open incidents match, and when the target’s current pause answers another incident (a dependent paused from Pause what depends on X), even if the target has an open incident of its own: it says how many match, lists the most relevant first and chooses the incident the current pause answers for you. Choosing No incident links none, and recovery is then not verified.

• Pause and resume an agent or a workflow. The gateway refuses new requests with HTTP 423 within about a minute, runs in flight fail on their next call and the SDK’s status check refuses new steps; resume undoes it.
• Pause what depends on X for a failing tool, model, data source, MCP server or provider: it lists the dependents with their runs, and each one you select is its own request with its own approval. For a model or provider it also shows which dependents a declared fallback would keep serving. A dependent whose pause already waits for approval is not offered again: its row opens the waiting request.
• Approvals open in place, for every role. Each approval waiting on a node has its own Open approval, named by the approval’s title (for example Open approval: Pause workflow Support Ticket Resolution); approvals with the same title also say when each was requested (Open approval: Approve lookup_order (requested 14:02 UTC)). Approving needs the approval permission, the required role and the permission of the work it unlocks; four‑eyes never blocks a rejection. The sheet says you can still reject only when your role allows it.
• Acknowledge and Escalate an incident, or declare one on an agent or workflow.
• Switch model changes an agent’s default model. Your app must apply it: the gateway does not enforce a default model, and Worksi reports when a switch was not applied.
• Require tool approval makes each run that calls the tool wait for a person’s approval: one request per run, effective within 30 seconds; a run waits up to 5 minutes, then fails.
• Add a policy on the node’s scope, configure fallbacks of a model, or register something discovered in your traffic.

A pause contains a problem; it is never shown as a recovery. Each check on the map names its incident. While an agent is paused, a recovery check of another incident says it cannot verify recovery until the resume, and a recovery that no longer holds (the node fails again, or a newer incident opened) is marked Earlier. Recovery is verified on new traffic after the fix, as in Incidents.

Roles, plans and the keyboard#

Every role can read the map. The controls follow their own permissions, and viewers and auditors see each control with the reason it is unavailable; every role can open an approval to read it. On a plan without the AI Graph the page shows a preview of your registry only (declared nodes and relations, no traffic, no states), and nothing about your organization is stored for it.

The map is one tab stop. The arrow keys follow the relations (right to what a node depends on, left to what depends on it, up and down within a lane), Enter opens the details and Esc steps back. While the map has focus, / searches, i toggles dependency impact, f fits the whole map, t switches to the table and l turns Live on or off; ? lists every shortcut, and closing it puts you back on the card you were on.