-
-
Upload agents, tools and handoffs to map the workflow.
-
Compare Haiku and Sonnet using paired outcomes and 95% probability ranges.
-
Upload reviewed traces to estimate mistake probabilities, mean loss and tail risk.
-
Era CRM, support and chat records feed matched agent and reviewer tests.
-
19-customer study: task failures with memory and review on or off.
-
12 Era-derived stress cases: memory, reviewer comparisons and 95% probability ranges.
Inspiration
A booking agent chooses the wrong flight. A reviewer blocks a valid request. Adding safeguards changes both risk and useful work, but teams need evidence to decide which changes help.
RiskGraph estimates what agent mistakes could cost before deployment. Engineering and risk teams can compare safeguards using reviewed traces, simulations and uncertainty bounds. The reports also give insurers a way to examine agent-related exposure.
What it does
- Map the workflow. Upload a JSON description of agents, tools, handoffs, trusted records and safety checks.
- Add reviewed outcomes. Import activity logs from real use or sandbox tests. Built-in refund, travel, privacy and enterprise examples show the format. Custom workflows run through a sandbox adapter.
- Compare safeguards. Inspect the same tasks with memory and critic review on or off. Count mistakes prevented, mistakes introduced and valid tasks completed.
- Estimate deployment risk. Explore mistake probabilities, expected cost and the chance of exceeding a loss threshold. Adjust traffic and cost assumptions to see how the estimates change.
Animated graphs connect actions to source records, reviews and outcomes. Proposed losses and losses after execution checks have separate labels.
Try it without an account: follow a saved decision, compare safeguards, then adjust the loss threshold. The public demo uses recorded results and makes no paid model calls.
Enterprise evaluation with Era and SurrealDB
Era supplies connected CRM, support and chat records. SurrealDB Agent Memory supplies reusable procedures with retrieval receipts linking them to their sources.
The source snapshot contains 842 CRM accounts, 60 support organizations, 1,800 tickets and 184 messages from 16 customer channels. An initial study found that Sonnet sometimes described the correct calculation but returned a different amount. The critic also changed some valid ticket lists into incorrect ones.
The revision shortened guidance, filtered out outdated and unrelated procedures, and required the critic to check each action field against supplied records. Fields it marks correct must be preserved.
A preregistered follow-up used 12 fresh stress variations derived from Era records and 144 real API calls. Haiku and Sonnet received identical records and output settings. Memory added two procedures retrieved from hosted SurrealDB. Both critics reviewed the same initial proposals.
Failed tasks out of 12:
| Model | Memory | Memory + earlier critic | Memory + revised critic |
|---|---|---|---|
| Haiku | 2 | 1 | 2 |
| Sonnet | 4 | 1 | 1 |
Without memory or review, both models failed all 12 tasks on the exact citation-ID requirement. Memory removed those citation errors. Amount errors are counted separately: Sonnet had five without memory, four with memory and one after either critic.
Without memory, the revised critic fixed three Haiku and five Sonnet citation failures that the earlier critic missed. Both critics preserved all 18 initially valid memory-on answers. The revised critic retained a Haiku ticket-list error that the earlier critic fixed.
The graphs show counts and 95% Bayesian ranges: 2/12 spans 3.6% to 43.6%, while 1/12 spans 0.9% to 32.8%. The earlier 19-customer experiment remains available separately.
Explore the enterprise results
Privacy and hallucination tests
The latest privacy experiment used 144 real API calls on 12 fresh tasks, comparing three retrieval packages with and without Sonnet review.
- Both models made 4 classified errors in 12 tasks with the earlier retrieval package and 0 in 12 with the revised package, which checks disclosure through aliases and citations.
- All setups answered the four legitimate control tasks correctly. The revised execution guard preserved those answers.
- The critic preserved all 24 valid answers from the revised package.
- The no-memory baseline also had 0/12 errors; its critic introduced one error for each model.
For 0/12, the Bayesian estimate is 3.85%, with a central 95% range of 0.004% to 18.53%. These estimates describe the synthetic test mix. Costs use stated planning assumptions.
How risk is estimated
One complete task counts as one observation, across all its agents. For a fixed setup and scenario, model binary mistakes as independent Bernoulli outcomes with probability p. Starting with the Jeffreys prior Beta(1/2, 1/2), k mistakes in n reviewed tasks give:
$$ p \mid k,n \sim \operatorname{Beta}\left(k+\tfrac12,\ n-k+\tfrac12\right). $$
The mean is (k + 1/2)/(n + 1). Posterior quantiles give the 95% Bayesian range. This retains uncertainty after a small sample, including one with no observed mistakes.
For nonnegative loss L with finite mean and Pr(L > 0) > 0, expected loss separates into frequency and severity:
$$ \mathbb{E}[L]=\Pr(L>0)\,\mathbb{E}[L\mid L>0]. $$
The privacy model uses mutually exclusive error classes plus a no-error class. A Dirichlet posterior updates their probabilities. Each class has a cost range covering response expenses, staff time and optional impact valuation.
If class j has probability p_j and loss lies in [a_j, b_j], the probability of exceeding threshold t satisfies:
$$ \sum_j p_j\,\mathbf{1}{a_j>t} \;\leq\;\Pr(L>t)\;\leq\; \sum_j p_j\,\mathbf{1}{b_j>t}. $$
The report propagates probability uncertainty through these cost and tail bounds. It does not require a chosen severity distribution within each range.
Safeguard comparisons use paired outcomes from the same tasks. Bayesian ranges describe model uncertainty; separate simultaneous confidence bounds account for the displayed comparisons under their sampling assumptions. Real traces and simulations keep separate models, combined through declared source and traffic weights. Missing labels and untested traffic widen the risk range.
How memory and review work
SurrealDB stores reusable procedures and prior incidents with source and retrieval identifiers. Retrieval selects current guidance for the relevant workflow. Trusted records determine permissions and allowed actions.
In the privacy workflow, disclosure checks follow restrictions through aliases and citation IDs. Haiku and Sonnet produce structured decisions; a separate Sonnet critic reviews them. Deterministic checks control sandbox execution. The reports include errors introduced by review and valid work lost to restrictive checks.
Built and tested
Python, FastAPI, NumPy, SciPy and SQLite handle analysis and recorded evidence. JavaScript and SVG animate decisions and probability updates. Render hosts the application; GitHub holds the code, protocols and reproducible studies.
Keeping task IDs, source records and outcome labels consistent was the main engineering challenge. Structured responses and independent scoring link each estimate to its evidence. Replaying a decision never adds another observation.
356 automated tests cover the application, statistical calculations and matched comparisons. CI also checks six Lean theorems about the reference risk gate; separate tests check Python conformance. Experiment archives preserve prompts, settings, responses, source hashes and token usage.
Next steps
Add sandbox adapters and reviewed operational trace streams. Extend failure catalogues and risk budgets for specific deployment workloads.
Credits
Built during Build North with coding and design assistance from Codex and Claude. The product film uses original animated characters and Runway-generated narration. Statistical references and open-source dependencies are listed in the repository.
