A Search Index Finds Records. A Business Graph Explains Relationships.

Consider an illustrative security questionnaire asking whether a product encrypts customer backups and who approved the current retention period. Search returns an architecture document, a control description, two completed questionnaires, a ticket from last year, and a policy page. Every result contains the right keywords. Only some apply to the product, environment, and review period in question.

Finding records is necessary. The agent also has to understand their relationships: which control covers which system, who owns it, what evidence supports it, and whether a newer decision replaced the older one.

Relevance does not establish applicability

A search index can rank documents using text, metadata, permissions, activity, and other signals. It answers a valuable question: which records are most likely to help with this request?

The security review asks additional questions:

• Does this control apply to the product being assessed?
• Is the evidence for production or a test environment?
• Which policy version was effective during the review period?
• Does the named approver still own the control?
• Did a later exception narrow the claim?

These are relationship questions. They connect controls to systems, evidence to time periods, people to roles, and exceptions to the policies they modify.

A business graph represents entities and relationships across fragmented enterprise data. It can make scattered evidence navigable, but it is not automatically trustworthy merely because it contains more connections.

Entity resolution is where many graphs become uncertain

The same product may appear under a formal name in a control system, an abbreviation in tickets, and a repository name in code. The same employee may have changed teams or used different accounts. A customer record may have parent and subsidiary entities that share documents but not contractual terms.

Linking those records requires entity resolution. Some matches are deterministic, such as an immutable system identifier. Others are inferred from names, domains, references, or activity.

An agent should not treat those two kinds of edge as equal. If a security answer depends on an inferred product match, that uncertainty belongs in the output or review path. Hiding it inside a graph converts a retrieval ambiguity into a confident business claim.

Permissions must apply after relationships are traversed

Relationship traversal can reveal sensitive information indirectly. A user may have access to a control document but not to the incident connected to it. A graph query that returns the incident title, customer name, or restricted project through an edge can bypass the spirit of source permissions even if the underlying document remains closed.

Permission checks therefore have to travel with retrieval and traversal. The system must consider both the requesting identity and the permitted role of the agent. The Coryntas security and governance approach keeps identity, source authority, policy, approvals, and evidence inside the execution path for this reason.

This has a cost. Permission-aware graph traversal is harder to cache, test, and explain than a public knowledge graph. It can also produce apparently incomplete answers when the user cannot see a connected source. That incompleteness should be explicit rather than repaired with an unauthorized inference.

Search and relationships should challenge each other

The best result is not always the most connected node. A widely referenced policy may be obsolete. A new control record may have little activity but be the current source of truth.

A useful retrieval path can combine the two systems:

1. search narrows the candidate records;
2. relationships identify the relevant product, owner, policy, and evidence;
3. authority and effective dates test applicability;
4. permissions remove inaccessible paths; and
5. the agent returns the answer with the supporting record chain.

The security review preparation workflow reflects this requirement by retrieving approved evidence, surfacing gaps and conflicts, and keeping external delivery under human control.

A search index helps an agent find the room. A business graph can explain how the objects in that room relate. The accountable decision still depends on authority, time, permission, and a reviewer who can inspect the path.