GraphEvo · AI Agents Studio

Ingest events

Upload a JSON Lines file. In Simulation mode the prepared payload is shown on screen but not sent. In Live mode the call is POSTed to IndyKite using the App Agent credential configured for this deployment.

Drop a .jsonl file here or click to browse · max 10 MB

Recent ingestions

Last 20 ingestions you've run.

No ingestions yet.

Import users from Entra ID

Reads all enabled users from your Entra tenant and writes them to the Identity Knowledge Graph as User and Person nodes (with manager relationships) via the Capture API. Admin only.

Import workflows

Reads the workflow master list and writes Workflow nodes plus their governance links (owned-by department, authored-by and approved-by person) to the Identity Knowledge Graph via the Capture API. Run the user import first so departments and people exist. Admin only.

Reconcile graph

One press: runs the user import (Users, Persons, Departments, can-trigger grants) then the workflow import (Workflow + Agent nodes, INVOKES chains) in the required order. Use after any workflow-seed change instead of the two buttons above. Safe to repeat (upserts); re-runs add duplicate identical INVOKES edges - harmless to the gateways, cleaned by a graph wipe when counts matter. Admin only.

Sync CIQ catalog

Reads the CIQ query master list (ciq-catalog-seed.json) and creates any missing knowledge queries + their policies in IK via the config API. Existing entries are never overwritten; description drift is reported. Idempotent - safe to run any time. Agents pick up new queries on their next chat automatically. Admin only.

IK Project

Read-only summary of the Context IQ configuration loaded from Key Vault. The credentials themselves stay server-side.

Loading: …

What I am to IK

Your identity, department, and the AI agent workflows you can run — read live from the IndyKite graph and reconciled against company policy.

Running query…

Raw response

Query Runner

Execute any knowledge query by its IK ID. Useful while iterating on policies/queries. Optionally pass input parameters (one per line, name=value).

Knowledge query ID Input params (optional)

Result will appear here.

Policies & Knowledge Queries

Lists what currently exists in IK (the single source of truth). Click an ID to copy it into the Query Runner above.

Authorization policies

Click Refresh to load.

Knowledge queries

Click Refresh to load.

Create authorization policy

Paste the inner policy JSON (the object — not pre-stringified). The server wraps and stringifies it. Author group only.

Name Policy JSON (inner object)

Create knowledge query

Paste the inner query JSON. Provide the policy_id it references. The server wraps and stringifies it. Author group only.

Name Policy ID Query JSON (inner object)

Mode

Agent activity

What the agent is doing — files read, tools called, LLM calls, sources cited.

Configured agents

Each user is routed to an agent based on their department.

Inter-agent delegation - token exchange tests

Runs RFC 8693 token exchange against Clave. Each test shows every token involved (decoded payload and raw JWT), so you can inspect the sub, act, and chain depth.

Test 1 - Agent-to-agent

Actor agent acts on behalf of subject agent. Validates basic delegation.

Subject (the principal) Actor (acts on behalf)

Test 2 - Agent on behalf of user

Actor agent acts on behalf of you (a Clave-signed user). Paste a Clave user access_token below (use your Alvicode-IDP-token-Exchange-FullValidation.ps1 to get one).

Actor (the agent) User access_token (Clave-issued, from auth-code flow)

Test 3 - Chained delegation

user -> outer agent -> inner agent. Uses the same user access_token as Test 2. Validates whether Clave preserves the chain by nesting act claims.

Outer agent Inner agent

Test 4 - End-to-end agent call

Full chain: exchange the user access_token for an acting-on-behalf token (caller=actor agent), then POST an A2A message/send to the deployed agent service URL and display its response. Validates that the deployed agent accepts the exchanged token's aud and returns a Claude answer.

Actor (the agent) Target agent Custom target agent URL Message to send User access_token (reuses the same token as Test 2/3 - paste once)

Verbose stream (live delegation events)

Test 5 - AuthZEN via MCP (delegated bearer)

Deterministically call the IK MCP authzen_evaluate tool with a delegated bearer built to a chosen depth - no LLM in the loop. Shows IK's raw decision/error and the decoded token chain, so you can see exactly which bearer the MCP accepts. Reuses the AuthZEN tab's checks and workflow list.

Delegation depth Check

subject_type resource_type action_name

Subject id Workflow (resource) Resource id User access_token (a fresh user token - the chain is built from this)

Security Audit

Look up any subject and see their master-data chain and what they can do. Admin only. Helps verify the data is in good shape before a demo.

Lookup Value

Raw response

AuthZEN decision runner

Ask IndyKite's AuthZEN engine "can this subject perform this action on this resource?" — a live allow/deny decision evaluated against the KBAC policies. Admin only. This is the same CAN_TRIGGER gate agent execution will use.

Check Subject Resource

Raw response

Welcome.

You're signed in as an agents user via Alvicode Clave. Agent features are still under construction. The full experience — including agent execution gated by the AuthZEN CAN_TRIGGER decisions you can see in the admin tooling — arrives once the token-exchange flow goes live.

For now you can sign out (top right) and re-enter via Microsoft if you need the admin tooling.

Developer: token claims received from Clave

Useful while the federation claims are being shaped on the IdP side. This panel will be hidden once the Clave integration is settled.

Loading claims…