Discover / Investigation
Code-to-cloud explorer
A bounded fixture path, not an enterprise-wide graph. Every relationship needs its own evidence; candidate and missing links stay visible.
The model-route and tool-to-data links are candidates. There is no proven complete path to disclosure; no exact blast-radius claim is possible.
Investigation controls
Evidence path
Dotted borders indicate unresolved relationships.
support-assistant → CI build #218
Run metadata links commit 8f3a7c; trusted attestation unavailable.
DEMO-EV-202
CI build #218 → support-assistant image
Digest in CI output; builder identity not independently verified.
DEMO-EV-203
support-assistant image → support-api / us-east-1
Digest recorded in a dated deployment snapshot, not a current live check.
DEMO-EV-204
support-api / us-east-1 → support-service-role
Workload binding in synthetic snapshot; issuance telemetry unavailable.
DEMO-EV-205
support-service-role → Bedrock model route
Configuration names a route; invocation not observed.
DEMO-EV-102
Support assistant → export_cases binding
Tool is offered. No execution receipt.
DEMO-EV-104
export_cases binding → Restricted HR source
Broad service grant suggests potential reach. Source authorization not verified.
DEMO-EV-206
Restricted HR source → Support assistant
Chunk version and ACL revision mapping missing; do not infer retrieval or disclosure.
Not collected