Frequently Asked Questions

Graphio is an execution governance platform and an Execution GPS for people and third-party AI agents. It connects to the business systems your organization already uses through authorized APIs and reads permitted metadata, events, actions, statuses, timestamps, ownership changes, business object relationships, and non-sensitive values. Graphio never analyzes the content of communications, emails, chat messages, call transcripts, notes, documents, or files.

Graphio uses those signals to reconstruct how work actually runs across every team, system, and handoff, without interviews, manual process mapping, or manual documentation. The discovered process executions stay under the hood. What Graphio presents is a business case: a statistically derived, actionable BPR (business process reengineering) scope that proposes how the work should run, together with a live comparison showing how teams are executing right now against that proposed business process.

Customer-created unique field values are read only after explicit authorization and only where they are non-sensitive. Graphio also maintains a private Sovereign Model inside the customer's isolated environment and uses the proposed business process to guide and govern approved third-party agents and to alert people when live execution drifts away from it.

Most business processes cross several teams and systems, but no individual tool shows the full execution chain. The gaps between CRM, project management, support, communication, finance, and other systems are where delays, missed handoffs, duplicated work, control failures, and revenue leakage accumulate.

Graphio reconstructs that end-to-end chain and turns the statistical evidence into a business case: an actionable BPR scope proposing how the work should run, plus a real-time view of how teams are executing against that proposed business process. Leaders do not receive a raw process map to interpret; they receive a scope to approve and a live gap to close. This gives early warning while the execution is still recoverable, rather than only reporting the failure after it has happened.

The Winning Path is the evidence-based business process Graphio proposes from your organization's own execution history. It is the core of the BPR scope, not a picture of how work happens to run today.

For each recurring business case, Graphio compares three cohorts:

• average executions - the normal performance baseline
• failure executions - stalled, escalated, abandoned, or low-outcome cases that reveal anti-patterns
• successful executions - cases with stronger outcomes and no statistically significant failure patterns

Graphio extracts the sequence, timing, handoffs, role assignments, and control constraints shared by successful executions and assembles them into a proposed business process. The individual discovered executions behind it stay under the hood; what leaders work with is the proposed process and the live comparison against it. Graphio does not copy one employee or invent a theoretical ideal. The Winning Path is customizable and is continuously refined as new executions are observed.

The Workflow Map is the structured representation of a validated business case: its proposed business process and the Winning Path at its core. It can show:

• steps, roles, systems, handoffs, and expected timing
• branches, gateways, exception paths, and escalation triggers
• SLA and compliance control points
• AI readiness classifications and automation boundaries
• failure-pattern warnings and deviation signals
• how teams are executing right now compared with the proposed business process

The same validated model can be viewed as a sequence of steps, a Gantt timeline, or a BPMN 2.0 diagram, always alongside current execution. It supports human process governance and provides machine-readable context for approved third-party AI agents.

Yes. A proposed business process can be expressed as a clear step sequence with owners and timing expectations. Business cases with branching logic, parallel work, exception paths, or segment-specific behavior are represented with gateways, conditions, authorized alternatives, and escalation paths in the Workflow Map.

Graphio therefore does not force every execution into one rigid straight line. When it compares live execution with the proposed business process, it distinguishes valid variants from harmful deviations.

Graphio is designed for leaders responsible for execution across teams, systems, and AI initiatives. Typical users include:

• Chief Transformation Officers and Chief AI Officers
• COOs, CROs, CCOs, CIOs, and other operating executives
• VPs and Directors of Operations, RevOps, Customer Success, Support, Compliance, and Process Excellence
• process owners, process architects, AI governance teams, and transformation consultants

They use Graphio to prioritize execution risk, review and approve the proposed business process, scope BPR work with statistical backing, quantify operational impact, prepare work for AI, and govern human and agent execution from the same standard.

Graphio uses one continuous processing flow:

1. Connect - authorized API connections provide permitted metadata, events, actions, statuses, timestamps, record relationships, and non-sensitive values. The content of communications, emails, and files is never analyzed.
2. Normalize - system activity, state changes, assignments, object relationships, and fields from different systems are converted into one canonical structure.
3. Correlate - related work is linked across systems, even when there is no shared case ID.
4. Discover - recurring execution structures are grouped into comparable business cases without interviews or manual mapping. This discovery layer stays under the hood.
5. Learn - successful, average, and failed execution cohorts reveal winning patterns, failure patterns, bottlenecks, and duplicate process variants.
6. Derive - Graphio builds the proposed business process and its BPR scope from the statistics, and continuously refines both as new evidence arrives.
7. Assess and quantify - each business case and step is scored for importance, AI readiness, time cost, money cost, and deviation risk.
8. Train privately - permitted customer-specific execution evidence improves the tenant-isolated Sovereign Model.
9. Govern - people see how they are executing right now against the proposed business process and receive alerts and corrective guidance, while approved third-party agents receive agent-appropriate instructions and controls through MCP and APIs.

Graphio groups permitted events and actions around business entities such as an opportunity, account, ticket, task, claim, contract, or project item. It then links timestamps, status changes, ownership changes, non-sensitive values, object relationships, and cross-system handoffs into ordered execution episodes. It does this without reading the content of communications, emails, or files.

Repeated sequences, role patterns, timing profiles, branches, system transitions, and outcomes form a business case. Discovery surfaces formal workflows, undocumented workarounds, duplicate variants, hidden coordination steps, and tribal knowledge without interviews, workshops, or manual documentation. That discovery layer is not what users work with day to day: it is the statistical input from which Graphio builds the proposed business process and the BPR scope shown in the product.

Graphio combines multiple signals instead of depending on one fragile field. These can include:

• explicit cross-system references where available
• business object relationships and structured identifiers
• event and activity timing, order, and recurrence
• status, stage, ownership, and assignment transitions
• recurring role and system interaction patterns
• non-sensitive system-defined values such as category, priority, stage, type, label, queue, and classification
• permitted non-sensitive customer-created field values when their analysis is enabled
• supporting technical metadata such as source system and record type

None of these signals require reading the content of communications, emails, or files. They contribute to a composite confidence score. When the evidence is ambiguous, Graphio can ask an authorized participant a structured clarification question and use the confirmed answer to improve future correlation.

Graphio assigns an importance and impact score to every discovered business case. The score can consider execution volume, time cost, money cost, failure rate, number of teams involved, revenue touched, compliance sensitivity, cross-system span, and deviation concentration.

Leaders start with the highest-impact business cases and their BPR scopes instead of an undifferentiated process catalog. Everything else remains available through filters by department, system, risk, AI readiness, and other dimensions.

Graphio builds an anti-pattern library from historically failed, stalled, or escalated executions. As a live execution develops, its structure is compared with those failure signatures.

If the current sequence, timing, handoff pattern, role assignment, or control behavior begins matching a known failure trajectory, Graphio can flag the risk before the final negative outcome occurs. The warning is based on the organization's own historical evidence, not a generic industry assumption.

Graphio separates:

• one-off incidents that should be flagged but not treated as a new standard
• authorized exception paths that are valid for a segment, account type, urgency level, claim type, or other defined condition
• systematic deviations that repeat and should affect alerts, remediation, or process redesign

Process owners can configure mandatory and optional steps, acceptable variants, exclusions, SLA thresholds, and authorized exception logic.

Graphio continuously updates its cohort models, correlation weights, and anti-pattern library as new executions arrive. It can detect changes in role ownership, routing, systems, timing, volume, or step sequence and measure whether the new pattern improves or harms outcomes.

If the evidence indicates that the proposed business process should change materially, Graphio produces an updated candidate BPR scope for human review rather than silently replacing the approved standard.

Graphio can generate a human-readable SOP from the proposed business process, including steps, roles, systems, timing guidance, branches, control points, and anti-pattern warnings. The SOP is the readable form of the same BPR scope.

Comparison of live execution against the proposed business process can begin automatically because it is observational and does not change customer systems. Process owners can pause, edit, or customize the proposed process at any time. Formal adoption as a controlled SOP and any permission for agents to act remain subject to validation and human approval.

Graphio supports 65+ integrations across CRM, project and work management, DevOps, communication, customer support, finance and ERP, HR, marketing, customer success, document management, banking, and insurance systems.

Representative systems include Salesforce, HubSpot, Microsoft Dynamics 365, Jira, Asana, GitHub, GitLab, Slack, Microsoft Teams, Gmail, Outlook, ServiceNow, Zendesk, NetSuite, Workday, Gainsight, FIS, Fiserv, Guidewire, and Duck Creek. Proprietary or heavily customized systems can connect through Graphio's ingestion API using a documented operational event schema covering objects, events, actions, timestamps, relationships, actors, assignments, status changes, and non-sensitive values. Communication, email, and file content is outside the schema and is never ingested for analysis.

No. Graphio sits above the systems your teams already use. It connects the execution signals between them, proposes the business process that should run across them, and governs execution against it.

Graphio itself is read-and-govern: it does not write to, modify, or delete records in connected customer systems. Approved third-party agents may act through their own integrations while using Graphio's Workflow Map and governance rules.

Graphio can provide an actionable conversational interface grounded in the platform's own analytics. Users can ask questions such as which business case is losing the most time, why a step repeatedly stalls, where teams are diverging from the proposed business process, or which business case should be prepared for AI first.

Answers include the supporting business cases, steps, executions, and metrics. When an approved action is available, the user must explicitly initiate it, and the third-party agent that performs the action remains subject to the same Winning Path, permissions, human gates, and audit controls.

AI Readiness measures whether a business case, or an individual step inside its proposed business process, is structurally stable enough to be safely prepared for AI-assisted execution. It evaluates execution evidence, not an employee's personal performance.

The assessment starts at the step level and aggregates to business case, department, and organization. Each level shows the drivers and blockers behind the score, so a company-level number can be traced back to the exact steps preventing broader automation.

AI Readiness answers can this be safely prepared for AI? Importance, impact, and automation saving potential answer should this be prioritized?

Each step is evaluated using permitted execution evidence:

• execution stability - consistency of sequence, timing, and outcomes
• ownership clarity - consistency of the responsible role
• data source coverage - whether completion can be observed reliably across connected systems
• anti-pattern exposure - how often the step appears near failure points
• compliance sensitivity - whether human or regulatory control must be preserved
• repeatability - how consistently the same predecessor and state lead into the step
• communication activity quality - consistency of timing, participants, response latency, and thread structure without reading message content
• standard value stability - predictability of relevant system-defined values in successful executions
• unique field signal stability - predictability of non-sensitive customer-created field values when their analysis has been explicitly enabled

The analytical ML layer calculates the score from permitted metadata, events, actions, statuses, timing, relationships, and non-sensitive values. It never uses the content of communications, emails, or files. A language model may explain the result in plain language, but it does not invent or independently calculate the score.

• AI Ready - stable execution, clear ownership, strong coverage, high repeatability, and low variability. The Workflow Map can proceed to agent preparation and handoff.
• Review Before AI - moderate readiness with specific blockers or coverage gaps that should be resolved first.
• Standardize First - unstable sequence, ownership, or execution variability makes automation unsafe until the process is improved.
• Low Evidence - there is not enough execution history or source coverage for a confident assessment.
• Not Recommended - compliance sensitivity, complex human judgment, or regulatory restrictions make AI-assisted execution inappropriate.

A single business case can contain a mix of statuses, allowing eligible steps to be prepared without waiting for every step in the proposed business process to become AI Ready.

No. AI Ready means the step or workflow is structurally eligible to be prepared for AI-assisted execution. It does not mean Graphio automatically creates, deploys, or authorizes an agent.

Graphio does not build proprietary agents. It makes agents from platforms such as Salesforce, Microsoft, OpenAI, Anthropic, and other providers more informed and controllable by supplying the Winning Path, success and failure patterns, current execution context, permitted actions, human gates, and escalation rules.

Graphio does not simply copy the best human path into an agent prompt. The safest route for an agent may require different tool calls, validations, ordering, or approval gates while still producing the same approved business outcome. During execution, an agent can query Graphio through MCP before acting. Graphio evaluates the proposed action against the approved Workflow Map and returns whether it is allowed, blocked, requires human approval, or should be corrected. If the agent moves off course, Graphio detects the drift through connected system APIs, alerts the right people, and records the event for governance and audit.

Graphio uses timestamps, state transitions, step boundaries, handoffs, and execution history to measure:

• median step and end-to-end time in the proposed business process
• typical time across the full business case
• time patterns associated with failed executions
• duration variance and outliers
• dwell time spent waiting before the next action
• the projected time penalty created by a deviation

This makes it possible to compare expected and actual timing in Steps and Gantt views and to identify where delay is concentrated.

Graphio combines timing measurements with organization-provided business inputs. Average role cost can come from a role-level CSV or an HR system, while deal value can come from CRM and lead cost from marketing systems.

This can produce:

• step cost and full process-instance cost
• Winning Path cost compared with average execution cost
• incremental deviation cost
• annual process cost at observed volume
• revenue at risk for relevant sales or renewal processes
• potential labor savings for AI Ready steps

Individual compensation does not need to be exposed. Role-level average costs are sufficient.

Work Time Intelligence shows how roles and teams allocate execution time across:

• process and activity categories
• client or account segments
• customer-facing work versus internal coordination
• proactive work versus reactive escalations and exceptions
• meeting, handoff, and administrative load
• utilization, overload, and genuine capacity headroom

It can also identify automation-eligible work, reallocation candidates, and activities that are structurally misaligned with a role.

This is not screen tracking or a stopwatch-based timesheet. It is an evidence-based execution and capacity model derived from permitted metadata, events, actions, statuses, timestamps, assignments, handoffs, meeting records, and other non-sensitive values. It never reads the content of communications, emails, or files. Results should be interpreted as operational allocation rather than a claim about every minute of active labor.

Yes. Graphio can establish a measured before-and-after for changes such as a reorganization, tool rollout, policy update, process redesign, market shift, AI-agent deployment, or the introduction of Graphio itself.

It compares like-for-like execution windows and measures changes in cycle time, cost, handoff density, completion and failure rates, role distribution, communication intensity, conformance to the proposed business process, and anti-pattern frequency.

Graphio reports the measured correlation and timing of the change. It does not claim causation when several changes overlap or the evidence is ambiguous.

Traditional process mining is strongest when clean event logs and a stable case identifier already exist. Graphio is designed for the cross-system environment where one identifier often does not follow the work end to end.

Graphio differs in several ways:

• it correlates activity across systems using multiple signals rather than requiring one shared ID
• it reconstructs formal and undocumented work without workshops or imported maps, and keeps that discovery layer under the hood
• it converts the statistics into an actionable BPR scope: a proposed business process derived from average, failure, and success cohorts, and continuously updated
• it shows how teams are executing right now against that proposed process and predicts failure trajectories in real time
• it scores AI readiness and quantifies time, money, and capacity impact
• it governs approved third-party agents through BPMN-based Workflow Maps, MCP, and APIs

BI tools primarily summarize outcomes after the metrics and data model have been defined. Graphio reconstructs the execution that produced those outcomes.

BI may show that win rate or onboarding speed declined. Graphio can identify the recurring handoff, delay, sequence, role, or control pattern associated with that decline, propose the business process that avoids it, show which active executions are drifting from that proposed process, and recommend the corrective path based on historical evidence.

An internal solution must do much more than connect APIs and build dashboards. It must normalize inconsistent event models, correlate work without one shared identifier, cluster comparable executions into business cases, separate success and failure cohorts, maintain anti-pattern libraries, turn the statistics into a defensible BPR scope, compare live execution against it, calculate AI readiness and impact, generate governed Workflow Maps, and keep all of this current as the organization changes.

Most internal programs solve one workflow or one department at a time. Graphio provides the shared discovery, intelligence, and governance layer as a continuously learning platform.

After required approvals and access are in place, a standard deployment can connect initial systems and surface the first business cases, proposed business processes, and execution gaps within about 48 hours.

Graphio uses authorized APIs and normally does not require custom code, replacement of existing systems, changes to current team workflows, interviews, or a manual process-mapping project. The exact timeline still depends on connector availability, customer access approvals, organization size, SSO configuration, and InfoSec requirements. Precision improves as more execution evidence is observed.

A standard start requires authorized API access to the relevant business systems and enough permitted information to observe:

• events and actions
• timestamps and duration
• status, stage, and ownership changes
• business object IDs and relationships
• roles, assignments, approvals, and handoffs
• non-sensitive system-defined values
• supporting technical metadata such as source system and record type

Access to the content of communications, emails, or files is not required and is never used. Non-sensitive customer-created field values are optional and require separate authorization. Enabling them can improve branch detection, segmentation, deviation explanations, AI Readiness, and the Sovereign Model's company-specific understanding.

Optional inputs such as organizational mappings, role-level cost, CRM deal value, lead cost, or intentionally uploaded SOPs and policies can improve specific outputs. Manual process maps and SOP uploads are not required for core discovery.

Yes. Authorized users can configure:

• success and failure thresholds
• importance and impact weights
• mandatory and optional steps
• authorized exception paths
• role assignments and ownership
• SLA and timing expectations
• AI and agent activation thresholds
• severity, recipients, and notification channels
• visibility, retention, and governance rules

Graphio provides an evidence-derived baseline without forcing every organization to accept the same operating standard.

Yes. Graphio can begin with a limited set of systems, departments, or business cases using read-only monitoring. Historical and live operational signals can be used to show the business cases found, the proposed business process for each, how teams are executing against it, AI readiness, and quantified impact before the scope is expanded.

Because Graphio itself does not modify customer systems, the evaluation can be performed without disrupting day-to-day execution.

Results depend on connected systems, permitted execution evidence, and the operating model. Common outcomes include:

• faster workflows and shorter waiting periods between teams
• earlier detection of stalled or failure-bound executions
• fewer duplicated process variants, loops, and repeated work
• clearer ownership and fewer roadblocks at handoffs
• better protection of the revenue lifecycle and earlier recovery of missed opportunities
• an evidence-based BPR scope and prioritization for process redesign and AI deployment
• AI Readiness at step, business case, department, and company levels
• more defensible time, cost, and capacity decisions

Graphio measures change against the organization's own execution baseline rather than promising one universal improvement percentage.

Graphio ties process findings to measurable business dimensions such as:

• time recovered by following the Winning Path
• dwell time and handoff delay reduced
• labor cost of steps, processes, and deviations
• annual process cost at observed volume
• revenue at risk in relevant sales and renewal workflows
• potential savings from AI Ready steps
• changes in failure rate, completion rate, and rework

The formulas use the organization's own timing evidence and configurable business inputs rather than a fixed industry assumption.

A deviation alert can include:

• what the proposed business process expected
• what was observed in the active execution
• the affected business case, step, roles, and systems
• severity and supporting evidence
• elapsed time and projected time or money impact
• the corrective action most likely to return the execution to a successful trajectory
• response options such as acknowledge, correct, escalate, or mark as an authorized exception

Alerts can be routed through the dashboard, chat, email, Slack, Microsoft Teams, or API webhooks according to severity and permissions.

Graphio is designed to understand how work moves, not the private content of what people write or say. Through authorized APIs, Graphio reads permitted metadata, events, actions, statuses, timestamps, ownership changes, business object relationships, handoffs, and non-sensitive values.

Graphio never analyzes the content of communications: no emails, chat messages, call transcripts, notes, documents, files, or attachments from connected systems. If an API returns a broader payload, Graphio extracts only the permitted operational signals and non-sensitive values needed for the approved purpose and excludes all content from downstream processing.

Customer-created unique field values are handled separately because Graphio cannot know in advance whether they hold operational values or sensitive information. They are read only after explicit authorization and only where they are non-sensitive. Customer SOPs, policies, or regulatory documents may be intentionally uploaded as an optional normative capability and remain isolated from connected-system execution data.

Graphio uses the minimum permitted information needed to reconstruct and evaluate execution. Typical inputs include:

• events and activities - what action occurred in a connected system
• timestamps - when an event, activity, state, or handoff started and completed
• status and stage transitions - how a lead, ticket, task, claim, contract, or other business object moved through its lifecycle
• business object identifiers and relationships - how records are connected within and across systems
• roles and actor references - who or which role performed, owned, approved, or received the work, subject to configured visibility
• ownership and assignment changes - when responsibility moved between people, roles, teams, or systems
• non-sensitive system-defined values - such as category, priority, stage, type, label, queue, and classification
• communication activity signals - participants, timestamps, volume, response latency, and thread relationships, never message content
• execution structure - sequence, dwell time, loops, parallel work, branches, and cross-system handoffs
• approved unique field values - non-sensitive customer-created field values, only when the customer separately enables their analysis
• supporting technical metadata - source system, record type, integration identifier, and similar technical context used to normalize and correlate activity

These signals allow Graphio to build business cases, compare successful and failed executions, derive and propose the business process, quantify time and cost, detect divergence from that proposed process, calculate AI Readiness, and improve the customer-specific Sovereign Model. The content of communications, emails, and files is never analyzed for any of this.

Unique fields are custom fields created by your organization inside systems such as Salesforce, Jira, ServiceNow, HubSpot, or an internal application. They are not part of the standard field set supplied by the platform or connector.

Examples include Renewal Risk Reason, Implementation Blocker, Strategic Account Tier, Manual Approval Required, Escalation Cause, Partner Type, or a company-specific process stage. A unique field may contain a picklist value, number, date, boolean, identifier, or free text.

Graphio treats unique fields separately because their meaning, allowed values, and sensitivity are company-specific. The same field name may mean different things in different organizations, and some values may hold sensitive business information. Graphio reads only non-sensitive values, and only where the customer has authorized it.

Unique fields often contain business rules and context that exist only inside your company. Their values can explain why a workflow took a different branch, why an approval was required, why a case was escalated, which customer segment was involved, why two records belong to the same execution, or why an execution succeeded or failed.

When access is enabled, Graphio can use those non-sensitive values to improve cross-system correlation, business case discovery, branch detection, the accuracy of the proposed business process, deviation explanations, segmentation, success and failure patterns, AI Readiness, the Sovereign Model, and the instructions supplied to approved third-party agents.

Graphio requests separate permission because it cannot assume every customer-created field is safe or relevant to analyze. The customer chooses which connected systems may expose unique field values and can disable the capability later.

Unique field values are analyzed only after explicit customer authorization, and only where they are non-sensitive. Graphio evaluates the field name, field type, allowed values, value pattern, relationship to events and actions, and how the value changes across successful, average, and failed executions. Free-text values that function as communication content are excluded. This allows Graphio to identify whether a field represents a branch condition, approval requirement, segment, risk signal, process state, or another company-specific execution rule.

Processing occurs inside the customer's isolated Graphio environment using self-hosted models. Unique field values are not sent to external AI providers, mixed with another customer's data, or used to train a shared cross-customer model. Access, retention, visibility, and downstream use follow tenant isolation, encryption, role-based access, and audit controls.

Graphio continues to read permitted metadata, events, actions, statuses, timestamps, non-sensitive system-defined values, state changes, assignments, relationships, and handoffs. It can still reconstruct many business cases, measure timing, detect handoffs, and identify common deviations from the proposed business process.

Graphio does not analyze values stored in customer-created fields. Only the field name, type, and structural presence may be available where the connector provides them. Some company-specific branches, connections, deviation reasons, segmentation rules, business-impact explanations, AI Readiness signals, Sovereign Model learning, or agent instructions may therefore remain invisible or carry lower confidence.

The customer can enable the setting later when it is ready to authorize those values.

Graphio separates analytical processing from language generation:

• open-source machine learning correlates activity, clusters executions into business cases, compares success and failure cohorts, detects anti-patterns, derives the proposed business process and BPR scope, calculates AI Readiness, prioritizes business cases, and quantifies time and money impact
• open-source language models turn structured analytical results into readable SOPs, explanations, insights, notifications, and governed agent instructions
• the tenant-isolated Sovereign Model learns customer-specific execution behavior from permitted events, activities, fields, process models, correction outcomes, and supporting technical metadata

Language models do not replace the underlying evidence or invent analytical scores. Customer-specific learning is not mixed across tenants. The content of communications, emails, and files from connected systems is never used, for analytics or for anything else.

Graphio is designed to retain analytical outcomes rather than a permanent archive of raw system activity. Permitted operational records and activity signals are kept only as long as needed to build and maintain the models and can be purged on a configurable retention window.

Derived assets such as Winning Path models, cohort statistics, AI readiness results, and Workflow Maps can persist according to the agreed configuration. During offboarding, API access can be revoked and export, deletion, and confirmation procedures follow the applicable contract and data-governance terms.

Core controls include encrypted transmission, encryption at rest, tenant isolation, least-privilege access, role-based authorization, encrypted integration and SSO credentials, restricted and logged ingestion access, configurable retention, centralized audit logging, and auditable agent actions and exports.

Graphio supports enterprise Single Sign-On, including Okta, Microsoft Entra ID (Azure Active Directory), and Google Workspace depending on deployment configuration. Organizations can enforce their existing identity-provider sign-in and MFA policies, while Graphio applies role-based permissions after authentication.

Access to sensitive process views, unique field values, Sovereign Model assets, and BPMN exports can be restricted by role. Critical or irreversible agent actions require explicit human approval and cannot bypass Workflow Map controls.

Yes. Graphio supports Single Sign-On so users can access the platform through the identity provider their company already manages. Supported configurations include Okta, Microsoft Entra ID (Azure Active Directory), and Google Workspace, depending on the deployment configuration.

SSO reduces separate passwords, centralizes authentication, and lets the organization apply its existing sign-in and multi-factor authentication policies. The identity provider confirms who the user is; Graphio then applies its own role-based permissions to determine which companies, departments, workflows, evidence, settings, and agent controls the user can access.

An authorized administrator enables Okta SSO in Graphio and enters the required Okta Domain, Client ID, and Client Secret from the organization's Okta configuration. Graphio provides a setup guide for the required values and connection steps.

The administrator should test SSO with an authorized user before disabling email and password login. At least one SSO method should remain configured and working to avoid locking administrators out of the platform. Okta credentials are encrypted at rest, and access to the SSO configuration is restricted and logged.

Yes. Visibility can be configured for company, department, business case, role, team, and approved actor-level views. Permissions can also control access to detailed process evidence, AI readiness drivers, compensation-related configuration, exports, normative documents, and agent actions.

The conversational interface follows the same access rules and cannot reveal data the user is not already authorized to view.

No. Graphio is not keystroke logging, screen recording, message reading, or productivity surveillance. It reads metadata, events, actions, statuses, and non-sensitive values only, and analyzes execution patterns, handoffs, roles, and timing. It never analyzes the content of communications, emails, or files.

Actor references can be used to understand ownership and routing, but AI Readiness and process scoring evaluate the structure of execution, not a person's private communications. Organizations can restrict detailed actor views and keep insights at role or department level.

Graphio does not install monitoring software on employee devices, but internal disclosure requirements depend on the organization's jurisdiction, policies, works-council obligations, and governance model.

Customers should align deployment and communication with their legal, privacy, HR, compliance, and InfoSec teams.

Most AI platforms use the same general-purpose base model for many customers. A Sovereign Model adds a private, customer-specific learning layer that runs on top of a self-hosted base model inside the customer's isolated Graphio environment.

The Sovereign Model learns from permitted execution evidence produced by Graphio, including metadata, events, actions, statuses, Workflow Maps, proposed business processes, timing, role and system relationships, success and failure patterns, deviation outcomes, approved corrections, non-sensitive system-defined values, and authorized non-sensitive unique field values. Intentionally uploaded SOPs or policies may also be used for their approved purpose. It does not learn from other customers and is not used to improve another customer's model.

Technically, the Sovereign Model is implemented as a LoRA adapter (Low-Rank Adaptation): a small trainable layer attached to a frozen base model rather than a giant model trained from scratch. This makes it faster to train, cheaper to run, easier to version, and easier to isolate per customer.

Its purpose is to learn how your company actually works and make your own execution intelligence more precise for your people and approved third-party agents. Under the standard contract, the customer owns the Sovereign Model adapter and the data behind it.

A general AI model can understand language, but it does not know how a specific company executes work. It does not know which handoffs usually produce the strongest outcomes, which field values change a branch, which exceptions are approved, which roles must review a step, or which patterns historically lead to missed revenue, delays, churn, or compliance exposure.

The Sovereign Model gives Graphio a private company-specific memory for execution. It turns permitted metadata, events, actions, statuses, non-sensitive values, execution history, and corrections into a more precise proposed business process, and into better explanations, SOPs, deviation summaries, recommended next steps, and agent instructions, while keeping the learning inside the customer's own environment.

It is better for company-specific execution intelligence, privacy, and governance. It is not automatically better at every general AI task.

A shared base model is useful for broad language understanding and reasoning. The Sovereign Model adds the private context that the shared model should not have: your workflows, your roles, your success patterns, your failure patterns, your approved exceptions, and your governance rules.

The best architecture is therefore not either/or. Graphio uses a strong base model for general capability and a private Sovereign Model layer for customer-specific execution behavior.

Graphio trains the Sovereign Model on permitted, tenant-specific execution signals. These may include structured Workflow Maps, Winning Path versions, step definitions, role and system mappings, timing patterns, AI Readiness classifications, deviation outcomes, correction traces, human approvals, and optional customer-provided SOPs or policies.

The training process updates only the small LoRA adapter. The base model remains frozen. This avoids rebuilding a full model for every customer and makes the customer-specific layer easier to isolate, audit, roll back, and retrain.

For core execution intelligence, the Sovereign Model uses permitted metadata, events, actions, statuses, non-sensitive values, approved unique field values, timing, relationships, and process models. It never analyzes the content of communications, emails, chat messages, call transcripts, notes, documents, files, or attachments from connected systems.

Customer-created unique fields are handled separately from standard system fields and are analyzed only after explicit authorization. Customer SOPs, playbooks, policies, or regulatory documents may be uploaded intentionally as optional normative references. When enabled, they are used for the approved purpose and remain isolated from other tenants.

The Sovereign Model runs inside the customer's isolated Graphio environment. Customer events, activities, structured fields, approved unique field values, process models, technical metadata, and trained adapter weights do not leave that controlled environment for AI processing.

Graphio does not send customer data to external AI model APIs or third-party model providers for training or inference. Customer-specific learning is not mixed across tenants.

The Sovereign Model makes third-party agents more aware of how your business works without turning Graphio into an agent vendor. Agents can query Graphio through MCP or API to receive the current process objective, permitted next action, role constraint, validation rule, human gate, exception logic, and failure-pattern warning for a specific execution.

The best route for an agent is not always identical to the route used by the strongest human performers. An agent may need different tool calls, ordering, validations, evidence checks, or approval gates. Graphio uses the human Winning Path as the evidence-based standard, then adapts it into an agent-appropriate path that preserves the approved outcome and governance rules.

As the Sovereign Model learns from permitted execution outcomes and corrections, agent guidance becomes more company-specific: what usually works here, what usually fails here, and when a person must be pulled in.

Traditional full fine-tuning can update a large portion of the model, which can be expensive, harder to isolate, and harder to manage per customer. A LoRA-based Sovereign Model keeps the base model frozen and trains a much smaller adapter layer.

For Graphio, that means the customer-specific learning can be stored, versioned, audited, retrained, and removed independently from the base model. It also makes it practical to maintain a private learning layer for each customer instead of one shared model trained on everyone.

Yes. The adapter can be versioned separately from the base model. Graphio can preserve training dataset references, training window, model version, validation results, and approval status for governance review.

If a newer version performs worse, creates unclear explanations, or fails a validation threshold, the customer can keep using the previous approved version while the new one is reviewed or retrained.

The customer owns its execution data and its customer-specific Sovereign Model adapter under the standard contract. Graphio may provide the platform, base model runtime, training pipeline, validation tools, and governance controls, but the learned customer-specific layer is not shared with other customers and is not used to train a common cross-customer model.

A validated business case and its proposed business process can be represented in three coordinated views:

• Steps - an ordered view for process participants, onboarding, and SOP review
• Gantt - a time-axis view for dependencies, bottlenecks, SLA thresholds, and comparison of current execution against the proposed business process
• BPMN 2.0 - a standards-based view of branches, gateways, exceptions, escalations, roles, and systems

BPMN can be exported as BPMN 2.0 XML. Visual snapshots can be exported in PNG, SVG, or PDF where enabled. Structured real-time agent context is delivered through Graphio's MCP server and REST API rather than relying on a static document.

Yes. The BPMN 2.0 XML export can include steps, sequence flows, branches, gateways, swimlanes, timers, control points, exception paths, and diagram layout data.

It is designed for import into BPMN-compatible tools such as Camunda, Activiti, IBM BPM, SAP Signavio, Bizagi, and Microsoft Visio, subject to the target tool's import behavior and the customer's permissions.

Approved third-party agents query Graphio's native MCP server or REST API before and during execution. They can receive the current step, permitted next actions, role constraints, gateway conditions, compliance checkpoints, escalation triggers, and anti-pattern watchlist.

BPMN-native agents or engines can also retrieve the full BPMN 2.0 XML. All agents receive the current approved map version rather than an outdated static playbook.

Not necessarily. The Winning Path defines the approved business outcome, control points, evidence, timing, and boundaries. Graphio can translate that standard into an agent-specific execution path because an agent may interact with systems differently from a person.

For example, an agent may use an API instead of a user interface, validate several fields before one action, request human approval earlier, or execute approved steps in a different technical order. Any adapted path must still satisfy the same required outcome, permissions, compliance controls, human gates, and audit requirements.

No. Graphio provides the execution intelligence and governance layer for agents the customer already uses or builds. It supplies the Winning Path, Workflow Map, real-time execution context, permissions, and deviation controls.

The third-party agent performs actions through its own integration. Graphio itself does not write to, modify, or delete records in connected customer systems.

Every agent action can be evaluated against the active Winning Path. Depending on severity, Graphio can:

• return corrected next-step instructions
• pause execution and request human review
• issue a hard stop for agent-excluded or irreversible actions
• notify the process owner or compliance role
• record the full execution and correction trace for audit

Automatable steps may proceed within their approved scope. Human-gated steps require approval, and agent-excluded steps cannot be performed by the agent.

Graphio's primary benchmark is the organization's own execution history. Each business case is evaluated against its average, failure, and success cohorts, and the proposed business process is extracted from the structural pattern shared by the strongest outcomes.

This makes the benchmark specific to the organization's systems, roles, clients, controls, and operating conditions rather than dependent on a generic industry template.

No, not for core discovery, prediction, AI readiness, or governance. Those capabilities work from the customer's own permitted metadata, events, actions, statuses, non-sensitive values, and execution history, and do not require another company's data.

If cross-company benchmarking is offered in a specific deployment, it should be handled as a separate optional capability using anonymized and aggregated data with explicit governance. It should not replace the customer-specific proposed business process.

Graphio helps financial institutions govern processes that cross origination, underwriting, operations, risk, compliance, servicing, and customer-facing systems.

It can surface stalled handoffs, unassigned cases, silent queues, excessive rework, unclear ownership, and undocumented operating practices, then convert that evidence into a proposed business process and BPR scope for each business case. Time, cost, failure risk, and AI readiness are measured for the same business case, helping leaders prioritize operational improvement as well as control assurance.

Examples include:

• loan origination, underwriting, closing, and servicing handoffs
• new-account onboarding, KYC, and CIP workflows
• AML and BSA investigation and escalation chains
• SAR, CTR, dispute, and regulatory-response workflows
• approval, remediation, and control-point processes
• relationship-manager, product, operations, and renewal handoffs

Coverage depends on connected systems, the permitted metadata, events, actions, statuses, and non-sensitive values available from them, and the institution's selected scope.

Graphio can detect when a required step is missing, a control point is bypassed, ownership is substituted, a deadline is likely to be breached, or an active case begins matching a known failure pattern.

Customer SOPs, policies, and regulatory documents can be uploaded as optional normative references. Graphio compares observed execution with the proposed business process and the approved normative baseline, then routes discrepancies for human review rather than making legally binding decisions automatically.

Graphio uses authorized API access and reads permitted metadata, events, actions, statuses, timestamps, state changes, relationships, handoffs, and non-sensitive values, including approved non-sensitive unique field values. It never analyzes the content of communications: emails, messages, calls, documents, files, notes, or attachments from connected systems.

Security controls include tenant isolation, encryption in transit and at rest, least-privilege access, role-based authorization, configurable retention, centralized logging, and enterprise SSO. Supported SSO configurations include Okta, Microsoft Entra ID, and Google Workspace depending on the deployment. Customer-specific AI and ML processing runs inside the isolated environment without sending customer data to external model providers.

Graphio itself does not write to banking systems. Approved third-party agent actions are separately governed, auditable, and subject to human gates for critical or irreversible steps. The final approval timeline depends on the institution's vendor, security, legal, identity, and compliance review processes.

Insurance processes often break between intake, underwriting, claims, service, finance, legal, compliance, and broker-facing systems. Graphio reconstructs those cross-system executions, identifies where work waits, loops, loses ownership, or follows a failure trajectory, and turns that evidence into a business case with a proposed business process and BPR scope.

Carriers can use the same model to quantify cycle time and cost, improve control adherence, assess AI readiness, and govern approved agents without replacing core policy, claims, or underwriting platforms.

Examples include:

• claims intake, assignment, investigation, escalation, and reserve approval
• underwriting intake, referral, approval, and reinsurance handoffs
• policy issuance, endorsement, and renewal processes
• complaint escalation and regulatory response
• broker, account-management, service, finance, and legal coordination

The exact catalog of business cases is auto-discovered from permitted metadata, events, actions, statuses, assignments, relationships, and non-sensitive values, and can be filtered or governed according to the carrier's operating model.

Graphio connects to the current technology stack through authorized integrations and reads permitted metadata, events, actions, statuses, and non-sensitive values across platforms, never the content of communications, emails, or files. It does not require replacing claims, policy administration, underwriting, CRM, case-management, or communication tools.

The platform focuses on the cross-system chain: which handoff should happen next, how long it should take, which role owns it, where deviations begin, and which steps are safe or unsafe for AI-assisted execution.

Common examples include:

• lead follow-up and SDR-to-AE delays
• Sales-to-CS handoff gaps after a deal closes
• Legal and Finance approval bottlenecks
• onboarding work that starts late or loses ownership
• CS-to-Product or Engineering escalation failures
• renewal and expansion activity that begins too late

Graphio connects the full revenue workflow across systems, identifies the failure pattern, proposes the business process that avoids it, quantifies the time and revenue at risk, and monitors active executions for the same trajectory.

Graphio sits above CRM, support, communication, project, finance, enablement, and customer-success systems. It does not replace them.

It reconstructs execution across the full stack, derives the proposed business process from actual outcomes, measures handoff and timing gaps, and shows how teams are executing right now against that proposed process and against documented playbooks.

Graphio identifies which individual steps are AI Ready, which require standardization, and which must remain human-led. A validated Workflow Map then provides approved agents with current step context, permitted actions, routing logic, SLA expectations, and escalation rules.

Agent execution is monitored against the same Winning Path as human execution. Drift can trigger corrected instructions, a pause for human review, or a hard stop for excluded actions.

Pricing is typically scoped by organization size, number and type of connected systems, workflow coverage, governance requirements, deployment model, and support scope.

A commercial proposal should be based on the business cases and systems selected for the initial deployment rather than a generic one-size-fits-all package.

Yes. Graphio compares the strongest successful executions with average and failed cases to identify the sequence, timing, handoffs, role assignments, control points, and exceptions associated with better outcomes.

The result is not a copy of one person's behavior. It is a proposed business process supported by evidence across an execution cohort, delivered as a BPR scope, a living SOP, and a Workflow Map, alongside a live view of how teams are executing against it.

Tribal knowledge is the undocumented operating logic that experienced teams use to make work succeed: an informal check, a reliable escalation route, a hidden dependency, or a coordination step that never appeared in the official process.

Graphio can surface recurring undocumented steps from permitted metadata, events, actions, statuses, assignments, handoffs, and non-sensitive values, and generate a plain-language hypothesis explaining why they may exist. No content of communications, emails, or files is read to do this. The hypothesis is presented to an authorized process owner for confirmation rather than being activated as fact automatically. Confirmed knowledge can be included in the proposed business process and generated SOP.

New employees can learn from the proposed business process, which sets out the expected sequence, roles, systems, timing, handoffs, branches, and escalation rules. This reduces dependence on shadowing and informal memory alone.

Managers can also see how a new team member is executing right now against that proposed process and intervene early when they hit a recurring breakdown point.

The process knowledge does not have to leave with the individual. Graphio's models, proposed business process, Workflow Map, and living SOP preserve the repeatable execution structure learned from historical evidence.

The proposed process continues to evolve as the new team produces additional execution data, while material changes to it can be routed for human review.

Graphio documents execution structure from permitted metadata, events, actions, statuses, and non-sensitive values. It never reads the content of communications, emails, or files. The purpose is to preserve organizational execution knowledge and improve the way work runs, not to create hidden surveillance.

Non-sensitive customer-created field values are not analyzed unless the organization explicitly enables that access. Customers should also configure role-based access, actor-level visibility, exclusions, retention, and internal disclosure according to legal, HR, privacy, compliance, and works-council requirements.