Skip to content

Synthetic demo · No customer connectors attached · Fixture snapshot 24 Sep 2026, 06:15 UTC

Discover / Investigation

Code-to-cloud explorer

A bounded fixture path, not an enterprise-wide graph. Every relationship needs its own evidence; candidate and missing links stay visible.

Observed at 24 Sep 2026, 06:15 UTCWindow: synthetic snapshot · 22 Sep 2026 UTC

The model-route and tool-to-data links are candidates. There is no proven complete path to disclosure; no exact blast-radius claim is possible.

Investigation controls

Evidence path

Dotted borders indicate unresolved relationships.

declaredcommit → build

support-assistant → CI build #218

Run metadata links commit 8f3a7c; trusted attestation unavailable.

DEMO-EV-202

declaredbuild → artifact

CI build #218 → support-assistant image

Digest in CI output; builder identity not independently verified.

DEMO-EV-203

observedartifact → workload

support-assistant image → support-api / us-east-1

Digest recorded in a dated deployment snapshot, not a current live check.

DEMO-EV-204

observedworkload → identity

support-api / us-east-1 → support-service-role

Workload binding in synthetic snapshot; issuance telemetry unavailable.

DEMO-EV-205

candidateidentity → model route

support-service-role → Bedrock model route

Configuration names a route; invocation not observed.

DEMO-EV-102

declaredagent → offered tool

Support assistant → export_cases binding

Tool is offered. No execution receipt.

DEMO-EV-104

candidatetool → data

export_cases binding → Restricted HR source

Broad service grant suggests potential reach. Source authorization not verified.

DEMO-EV-206

missingsource → RAG chunk

Restricted HR source → Support assistant

Chunk version and ACL revision mapping missing; do not infer retrieval or disclosure.

Not collected

Data lineage