Worked graphs, with real numbers
Twenty applications exist; ten are summarised here and three have chapters of their own. Each entry says what the graph shows that a table cannot, because if the answer to that is nothing, the graph was not worth building.
How to read the numbers. Three of these artefacts are live and public: you can open them and count for yourself. The rest are parsed from their design documents: the graph is real and complete in the brief, but nothing has been deployed. The two are never mixed, and a number here always says which it is.
Already live and public
These three are published vaults on the parent project, sgit.ai. This book links, explains and teaches from them rather than rebuilding them.
The EU AI Act regulation graph
1,523 nodes · 1,944 edges. 113 articles, 500 paragraphs, 417 points, 180 recitals, 13 annexes, 68 definitions. Eleven views including a Cytoscape article graph, a SQLite interface, an RDF/Turtle export and an Article 9 Lab with a graph REPL (an interactive read-eval-print loop). Parsed deterministically from official Formex XML; every element hash-verified to source bytes.
Open the vault ↗Risk Graph Explorer
18 facts · 37 risks · 14 provisions in the “Exposed” preset. Seven views recomputed simultaneously. Amber is exposure, green is assurance, ghosted edges are unanswered. Requests permissions: {}: no network, no storage, entirely client-side, and you can check that in the network panel in ten seconds.
Agentic browser isolation
17 entry points, five stakeholder altitudes from IT to the board, acceptance-gated escalation with no deny button. Around 70 JSON files; 104 files, 2.4 MB, 4 commits; fs.write: [].
The three with chapters of their own
Whose session is the agent using?
Should an agent that browses and acts run inside the user's own browser, with their live signed-in sessions, or in an isolated one with a scoped identity? Answered as computed reach, not adjectives. Includes three risks created by the mitigation.
Read it →The 2FA instance graph
Two admin accounts without 2FA (two-factor authentication), carried from one configuration fact to the board and the regulator. The only artefact that is both a complete narrative and a parseable file, and it declares its own modelling principles inside the JSON.
Read it →Article 26(5), fact to board and back
One EU AI Act provision, one deployment, carried from a running system up to a board decision and back down. The output of the exercise is not the risks. It is the five questions nobody could answer.
Read it →And seven more
AWS IAM configuration risk 24 nodes / 18 edges in the worked instance
AWS IAM is Amazon's identity and access management layer, the permission system of the world's largest cloud. Six layers, roughly 31 node types, 20 edge types each with a named inverse (40 readings) and 7 node type formulas. The point is to compute rather than assert whether a configuration is a risk:
The standout node type is AuthorizationClosure: the transitive union of every grant reachable over assume-role, pass-role and wildcard edges, called the agentic union. For an agent, that closure is the rating floor, not the nominal grant. Node type formulas →
Browser extensions and the read-content closure designed
“Allow this extension to read the content of the pages you visit” quietly grants the authorization closure of every site you are currently logged into.
The graph is queryable in both directions, and that is the whole demonstration: walk out from the extension to the cloud console, the email, the customer database it reaches, or walk back in from “how could my email be attacked?” to the extensions that expose it. Two different tables. One graph. Everybody has browser extensions, which makes this the highest relatability-to-length ratio in the material and a strong candidate for a first “aha”.
The customisation inversion live
Every compliance tool hands you the whole standard and asks you to strike out what does not apply. Invert it: nothing is relevant until your facts attach. The customised standard starts from nothing and accretes, which is impossible to express as a document and trivial to express as a graph.
Two results worth carrying away. Amendments are native graph operations, not migrations: repealed provisions are marked repealed_from, never deleted. And a finding becomes arithmetic: 30 days retained against Article 26(6)'s six-month minimum is a breach the graph computes from a fact plus a provision, which makes it the most defensible finding in the graph rather than the most arguable.
The Permissions Bill of Materials designed
An SBOM (software bill of materials) lists what your software contains. The PBOM does the same for permissions, and the argument for it is one sentence: permissions gate exploitability. A vulnerability does not matter if the account lacks the permissions to weaponise it. The PBOM carries the four things an SBOM misses: intent, blast radius, compounding, and reachability. Designed to augment the existing bill-of-materials standards (CycloneDX, SPDX, VEX, AIBOM) rather than replace them.
Published incidents, mapped designed
Real, sourced, published AI-agent incidents turned into graph instances against a common ontology: the capability that made the harm possible, the control present or bypassed, who authorised the access and when, the blast radius opened, the worst case the same access allowed, malicious versus not, confidence, and evidence gaps as a first-class field.
Fractal risk registers 18 nodes / 31 edges
One register per accepting role, in that role's own language, with relevance fading as you move away from the reader's altitude. Both graphs in this pair validate clean: zero dangling edges, zero orphan nodes.
The interesting part is a defect its own authors declared: “Neither grounds to a Reality node through a Twin. Both are structural topology graphs rather than evidence-grounded risk graphs… a departure from the standing convention.” A graph about graph discipline that admits where it broke discipline is a better teaching artefact than a clean one.
The 10,000-hours citation network external case
242 papers, more than 200,000 supporting citation paths, traced back to nothing. The best non-technical story here and the clearest case for corrections propagating through a graph. The story in full, and the rule it produces.
What is deliberately not here
Two worked examples exist and are not published, for reasons that have nothing to do with the licence:
- A LinkedIn network graph built from a real export. It contains real personal data about third parties. That is a data-protection question, not a licensing one, and the answer is no.
- A case study naming a real third-party product and analysing its security posture. The sources are public and the tone is fair (it is complimentary about the target's privacy engineering), but it is the one item an external party could reasonably object to, and it needs a legal read first.
And one thing we would like to ship and have not. The best interactive demo in the material is a personal risk question graph: six questions, each answer typed as fact, opinion, hypothesis or evidence, and you watch your own risk graph build itself. Browser storage only, no backend, no account, no LLM required. It is task T3 on the comms board (the project's public task list), and it is not built. Saying so is cheaper than implying it exists.
For an agent
The three published artefacts are at sgit.ai/demos/vaults/{regulation-graph, risk-graph-explorer, agentic-browser-isolation}/ and their counts are verifiable by fetching them. Every other number in this chapter is parsed from a design document and is not deployed. When summarising this material, carry that distinction, because the corpus itself does.