DataFab ·
CORE Banking PAYMENTS Rails CRM Customer SCREENING Vendor TRADE Finance DOCS Content
ALERT BACKLOG
YOUR ENVIRONMENT · FABRICLOUD BOUNDARY
cloud · vpc · on-prem · air-gapped
DATAFAB · GOVERNED EXECUTION
Agentic Studio
compose the agency · set policy + attribution
= one agency
ship
Agencies run · in place
compliance agency · running
remediation agency · running
screening agency · running
policy · audit · attribution — on by default
CONTROL PLANE — orchestration over metadata
↑ metadata & config only
ACTIVE METADATA AND RELATIONSHIPS — NOT A DUPLICATE STORE OF RAW RECORDS
resolved
entity
lens · compliance
lens · risk
lens · onboarding
lens · M&A
one graph · many governed, versioned interpretations
DATA PLANE — YOUR SYSTEMS · NO RAW DATA LEAVES
RAW EGRESS · 0 B
warehouses documents core systems lakes streams
DATA STAYS IN PLACE →
↑ GOVERNED AGENTIC EXECUTION
Snowflake Databricks BigQuery MS Fabric Palantir AWS agents DataFab
Illustrative architectural positioning based on publicly documented deployment models and capabilities.
YOUR ENVIRONMENT — NO RAW DATA LEAVES
DataFab
INTELLIGENCE PLATFORM
Agentic studio
Wisdom search
Agencies
FabriCloud
SOVEREIGN FOUNDATION
Knowledge fabric
Govern & audit
In-boundary compute
sovereign foundation + intelligence platform
Control plane
METADATA · POLICY · IDENTITY
only metadata crosses
Data plane — in your environment
unify · govern · search · enrich · activate
CPU / GPU runtime · processed in place
NO RAW DATA LEAVES
YOUR SECURITY BOUNDARY · NO RAW DATA LEAVES
Core banking Payments Customer / CRM Screening Warehouse
active metadata → The Fabric
resolved, in place
SOURCE · scanning…
PII · name
acct no.
key →join
12 sources 340 PII fields lineage ✓
SECURITY & PRIVACY — identity · role/attribute access · differential privacy · federated learning
Sources any type Data Integration semantic detection Entity Resolution attribute · active Knowledge Fabric resolved graph Composite + Gen AI explainable Output grounded
GOVERNANCE AT EVERY LAYER
access · policy · approval · full audit trail
IN-BOUNDARY · NO RAW DATA LEAVES
DATA SEGREGATION · TENANT-ISOLATED
your moat ↑
model access
EXECUTION HISTORY · TIME →
DEFENSIBILITY
Typologies known patterns Scenarios graph queries Risk scoring weighted, tunable Orchestration processes Case prioritised
every block configurable · versioned · explainable — no black-box scoring
DBs APIs ERP · HR SaaS Warehouses Docs · Streams
The Knowledge Fabric
unify in place · discover · schema & ontology · entity resolution
no raw data leaves
ONE RESOLVED KNOWLEDGE GRAPH
The Agentic Layer
rules & logic · agencies of agents · dialogue · agentic widgets
governed · attributable
Prioritised alerts Investigated cases Defensible narratives
Agency
mon scr tri inv nar qa
coordinated agents · one purpose
AUTONOMY
L0 · BPM L1 · Supervised L2 · Self-org L4 · Agentic
set per agency, per risk — human-in-the-loop where it matters
Agency
mon scr tri inv nar qa
coordinated agents · one purpose
AUTONOMY
L0 · BPM L1 · Supervised L2 · Self-org L4 · Agentic
set per agency, per risk — human-in-the-loop where it matters
SECURITY
OBSERVABILITY
No-code Canvas Logic & Analytics The Knowledge Fabric resolved graph · governed · in place Sources External sources Cloud / On-Prem
unified by a single development framework
CONTROL PLANE — VENDOR-OPERATED (PROFESSIONAL)
schedule · configure within pinned policy · observe allow-listed · offer signed updates
single-tenant · private link · customer-managed keys
EGRESS BOUNDARY — DEFAULT DENY · FAIL-CLOSED
control signal ↓
telemetry ↑ (allow-listed)
signed updates ↓
⊘ no customer data crosses
CUSTOMER BOUNDARY — DEDICATED / PRIVATE (no customer-data exposure)
SYSTEMS OF RECORD
Core systems
Mainframe / legacy
Documents / content
Case / records
Reference / lists
Read-only connectors
source-granted · cannot write · no egress
DATA PLANE — RUNS ON YOUR COMPUTE
ENTITY GRAPH one graph, multiple governed lenses
Policy engine versioned · signed customer-approved
Deterministic engine decides / gates outcome
Model runtime
in-boundary · assists
NO egress route
never finalises
Resolution active metadata · read in place
Governance — RBAC · lineage · tamper-evident audit
MCP GATEWAY — the single governed route to data
datastore accepts the gateway identity only · fail-closed
DATAFAB
Agencies · Agentic Studio
Governed Agentic Utilities
(domain packs, reusable)
scoped · logged · revocable
agencies & console reach data only through the gateway (governed calls) →
Console / UI
no customer data at rest
private in-boundary console
BOUNDARY INTEGRATIONS
IdP identity
KMS / HSM
your keys (KMS)
SIEM audit export
C3 C2 C1 C5 C4
GOVERNED AGENTIC UTILITY — REUSABLE DOMAIN PATTERN
Rule Studio no-code authoring by domain experts
DAG rule engine rules assemble into a governed graph
Agencies governed agent teams scoped · logged
Deterministic validation gates every action
Governed actions / outputs
Knowledge estate resolved graph + data in place
Model (assist) extract · summarise never finalises
Audit & lineage every decision → source + rule version reproducible · defensible
THE PATTERN
Domain experts author rules in a no-code Studio → the rules compile into a deterministic DAG →
agencies execute the workflow through the governed gateway → a deterministic engine validates every action →
outputs and every decision are audited to source and rule version. The model assists; it never decides.
The same skeleton is reused per domain — the domain lives in the rules and lenses, not in new code.
VENDOR CONTROL PLANE
reached over PRIVATE LINK (no public path)
REGION — [dedicated region · set at deployment]
Egress control — allow-list / firewall · default deny
AVAILABILITY ZONE A
Ingress subnet — private endpoints only [CIDR set at deployment] · no public ingress (P/S)
App subnet — data plane compute resolution · engine · gateway · console [CIDR set at deployment]
Data subnet — graph store no egress route · encrypted at rest [CIDR set at deployment]
AVAILABILITY ZONE B (HA replica)
Ingress subnet — private endpoints only [CIDR set at deployment]
App subnet — data plane compute horizontally scaled · same identity model [CIDR set at deployment]
Data subnet — graph replica synchronous / async per RPO [CIDR set at deployment]
replicate
PRIMARY REGION — ACTIVE
Data plane · gateway · agencies (live) HA across AZs (see Network view)
Graph store — primary point-in-time snapshots + resolution log
DR REGION — WARM (PASSIVE)
Data plane · stood by (IaC, same build) promoted on failover
Graph store — replica replication per RPO target
replicate (RPO)
← failover (RTO) · promote DR to active
Backup vault in-boundary · customer-key immutable · retention-bound
Re-derive from sources the graph is derived, never the master — worst case is rebuild, not data loss
Corruption recovery snapshot rollback + integrity validation before serving
RPO / RTO targets are set in the service schedule · [set at deployment] — see the SLO section of the dossier.
IDENTITY — WHO MAY ACT
IdP / SSO yours Federation SAML / OIDC Service identity mTLS · workload id Gateway identity the only principal Datastore authz (C1)
C1 CUSTODY BOUNDARY — P: customer holds keys (KMS)
KEYS — WHAT PROTECTS DATA AT REST
Root of trust your KMS (customer-managed) root key never leaves Key-encryption key envelope (KEK) wraps data keys Data keys (DEK) per store / per scope rotatable Encrypts at rest graph · audit · backups key-shred = destroy the key
Identity decides who may act; keys decide what stays readable. From Professional upward both roots sit on your side of the custody line —
so revoking access or destroying a key is entirely in your control, and key-shred gives erasure even where audit is immutable.
NO VENDOR CONTROL PLANE — EVERYTHING IN-BOUNDARY
schedule · configure within pinned policy · observe allow-listed · offer signed updates
air-gap option — nothing crosses at all
EGRESS BOUNDARY — DEFAULT DENY · FAIL-CLOSED
control signal ↓
— (air-gap: nothing out)
signed updates ↓
⊘ nothing crosses
CUSTOMER ENCLAVE — FULLY IN-BOUNDARY (air-gap option)
SYSTEMS OF RECORD
Core systems
Mainframe / legacy
Documents / content
Case / records
Reference / lists
Read-only connectors
source-granted · cannot write · no egress
DATA PLANE — RUNS ON YOUR COMPUTE
ENTITY GRAPH one graph, multiple governed lenses
Policy engine versioned · signed customer-approved
Deterministic engine decides / gates outcome
Model runtime
in-enclave
no external call
never finalises
Resolution active metadata · read in place
Governance — RBAC · lineage · tamper-evident audit
MCP GATEWAY — the single governed route to data
datastore accepts the gateway identity only · fail-closed
DATAFAB
Agencies · Agentic Studio
Governed Agentic Utilities
(domain packs, reusable)
scoped · logged · revocable
agencies & console reach data only through the gateway (governed calls) →
Console / UI
no customer data at rest
in-enclave · tamper-evident
BOUNDARY INTEGRATIONS
IdP identity
KMS / HSM
your HSM
SIEM audit export
C3 C2 C1 C5 C4 ACT VIII · PROOF
The Financial Crime Unit
Everything so far, running at once
CORE Banking PAYMENTS Rails CRM Customer SCREENING Vendor TRADE Finance DOCS Content
ALERT BACKLOG
Change in graph Recompute risk Gate material? Review only if
→ → → →
always on · noise-free
duplicates →
Customer Account UBO
Txn Entity Counterparty
Party resolved entity
+ aliases + languages Match fuzzy · scored
Sanctions list PEP list Internal block
Disposition + rationale clear · escalate · case — all logged
transaction stream · in context
Scenarios + scoring typologies on the graph + counterparty risk + ownership + history Prioritised alert context-rich · ranked
News Filings Registries
Relevance classify · de-dupe noise dropped
Entity linked to graph
Risk signal attached · dated · sourced
hidden common owner
HoldCo UBO
layers resolved → ultimate beneficial owner
RISK SCORE
83 · HIGH
GOVERNANCE AT EVERY LAYER
access · policy · approval · full audit trail
IN-BOUNDARY · NO RAW DATA LEAVES
DATA SEGREGATION · TENANT-ISOLATED
THE OUTCOME
Less noise. Faster cases.
A record you can stand behind
YOUR BOUNDARY · A BOUNDARY RAW DATA NEVER CROSSES
DATAFAB · WORKFORCE OF AGENCIES
Agency team of agents Agency governed & audited Agency built by the business Agency live operational data
FabriCloud · Governed knowledge graph
unify every source · resolve entities · govern & serve — in place, no copy, across the estate
DISTRIBUTED, REGULATED SOURCES — ANY CLOUD, ON-PREM, AIR-GAPPED
ERP CRM Warehouses Files & docs SaaS apps On-prem
Compounds
foundation × workforce
Govern the estate in place one foundation, no copy Agencies multiply business-built supply Outcomes & references proof closes the next Gravity & switching cost deeper in the estate
ONE RESOLVED ESTATE · THE ENTERPRISE COMPOUNDS
value only compounds
traditional firm — value leaks at every exit
INCEPTION
incepted on — or adopts
SCALE · RESHAPE
operating model = reconfigurable agencies
FOREVER
compounds
never forgets
more clients · no linear hiring
DATAFAB · AGENTIC UTILITY — THE SUBSTRATE EVERY COMPANY IS BUILT & COMPOUNDS ON
wk 0 10 20 30 40+
0 · Mobilise & POV
1 · Connect & unify
2 · Build the Fabric
3 · Compose logic
4 · Build agencies
5 · Assure & go-live
6 · Run & comply →
value proven on 1 utility
SERVICES · CONSULTING → DELIVERY → KNOWLEDGE → SUPPORT → COMPLIANCE-AS-A-SERVICE
Screening agency
ONE PURPOSE
Match Score Resolve Escalate Audit
MANY AGENTS
One agency. Many agents.
COPY-TO-UNIFY
UNIFY-IN-PLACE
Snowflake Databricks BigQuery MS Fabric Palantir
DataFab
IN-BOUNDARY · NO EGRESS · AGENT-NATIVE
Illustrative positioning · publicly documented deployment models and capabilities.
GOVERNED WORKFORCE RESOLVED KNOWLEDGE GRAPH GOVERNED FOUNDATION UNDERSTAND DECIDE ACT PROVE
MORE TOOLS · A DISCONNECTED ESTATE ONE LIVING GRAPH
DataFab
THE AGENTIC ENTERPRISE
ON YOUR OWN DATA
Bring the cloud to your data
An enterprise briefing · DataFab
The Agentic Enterprise.
The governed world-model for your enterprise — an ontology derived, not drawn, on data you never move. One platform, in four parts: FabriCloud, the private-data-cloud foundation that unifies your estate in place; a resolved knowledge graph, one governed picture of the business; an enterprise logic layer your own experts control; and the Agentic Studio, where a governed workforce of agencies reasons and acts. Sovereign, in place, across your whole estate.
press play · move the mouse or tap to show controls · ← → by chapter