Risk Narrative and Gradient of Control
In the Select Fire™ Preview step, read why the plan recommends each change, and how far each action can run on its own. Every number comes from the same risk engine the rest of GraphnAI uses.
Requires role: Operator or Admin (the plan and its autonomy badges). Admin, with a license that includes the AI features and remediation, for the risk narrative. Admin for the recommendation rationale on a receipt. Related: Select Fire™, Full-Auto Execution, Semi-Auto Execution, Remediation Reversibility and Undo, Closed-Loop Rollback
Overview
When you open Select Fire™ from a finding, the Preview step loads the identity's access sources and recommends a plan. Two parts of that plan explain it:
- The risk narrative says, in plain language, why the plan recommends these changes. An AI model writes the words. Every number it uses comes from the risk engine, never from the model. If the AI provider doesn't answer, a summary built only from the engine's numbers takes its place.
- The gradient of control shows, for each action, the highest autonomy level it can run at (Safe Mode, Semi-Auto or Full-Auto), and why it isn't higher. That ceiling is set when the plan loads. The kill switch, change windows and the hourly limit are checked again when the action runs.
Neither replaces the Decision step's risk analysis. The narrative answers "why these changes". The Decision step answers "what could break if the selected changes run".
Prerequisites
- At least one full sync has completed, so the risk engine has a baseline. Without one, there's no plan and no narrative.
- For the narrative: the Admin role, and a license that includes the AI features and remediation. Operators see the plan and its autonomy badges, but not the narrative.
- To run the plan, the prerequisites in Semi-Auto Execution and Full-Auto Execution apply.
The Plan-Step Risk Narrative
What it shows
The plan's headline sits above the access-source table. It reads, for example, "Lowers the risk score from 49.9 to 12.1", with the Primary driver and the Confidence under it. The projected score follows your selection as you check and clear actions. If the plan changes nothing, the headline reads "The risk score stays at 49.9." instead.
For an Admin, the Why this is recommended panel sits under the headline. It explains which risk factors the recommended changes lower, and why the engine chose them. When Confidence is Low, it adds what that means: "Confidence is Low: most of this account's permissions haven't been seen in use, so the projected score is an estimate."
While the text is written, the panel shows "Generating explanation…". If the request fails, it shows "Couldn't generate the explanation." with Retry. The primary driver and Confidence stay in the headline either way.
The numbers are the engine's
The AI model receives every number as a fixed value, with an instruction not to compute, estimate or change it. The risk score is the same one the Risk Posture Dashboard shows. The projected reduction is the same one in the plan's headline.
The AI model writes the explanation, and the engine does the math. The narrative request carries only factor values and projected changes. It has no field for blast radius counts, Operational Safety Metric™ scores or graph data, so the narrative can't make claims about them.
Fallback to a numbers-only summary
If the AI provider is down, times out or returns something that can't be read, the panel shows a summary built from the engine's numbers instead. It names the recommended changes and the factors they lower, for example "Recommended change: Organization Management. Lowers Permission Load, Criticality Gap."
The fallback is silent: you see an explanation and no error.
The narrative is written once per plan
The narrative is written once, for the recommended plan, when the Preview step loads. If you clear an action, the narrative stays as it was, because it describes the recommended plan. The headline's projected score updates as you change the selection. The Decision step's risk analysis covers the actions you actually selected.
The Two-Analysis Contract
Two separate AI analyses run at different points in Select Fire™. Neither repeats the other.
| Preview narrative | Decision step risk analysis | |
|---|---|---|
| When it runs | Once, when the Preview step loads, for the recommended plan | When you open the Decision step, and again after you change the selection |
| Answers | Why these changes? Which risk do they lower? | What could break if the selected changes run? |
| Engine inputs | Risk factors, projected changes, the factors each action lowers | Blast radius, Operational Safety Metric™ score, script context |
| Can't see | Blast radius, Operational Safety Metric, graph data, the script | The factor breakdown and the change per factor |
| Required role | Admin, with the AI features and remediation licensed | Admin, with the AI features and remediation licensed |
The two requests have different shapes and can't carry each other's inputs. The Preview request has no field for blast radius or safety scores. The Decision step request has no field for changes per factor.
Gradient of Control
The autonomy badge
Each row in the access-source table has a badge in its Autonomy column:
| Badge | Meaning |
|---|---|
| Full-Auto (green) | Can run on its own under a Full-Auto plan. |
| Semi-Auto (orange) | Capped at Semi-Auto. You authorize it. |
| Safe Mode (gray) | Capped at Safe Mode. Select Fire only writes a script. |
Hover a badge to read why. A Full-Auto badge reads "Can run in Full-Auto." A capped badge reads "Held at Semi-Auto because" followed by the reason.
Why not higher
The badge names the first check that held the action back. These are the reasons the engine can give when the plan loads:
| Reason in the tooltip | What it means |
|---|---|
| the target is Tier 0 or Tier 1 | High-value objects always need a person to authorize the change. |
| the change can't be undone | An action that can't be undone never runs on its own. |
| undoing it needs a confirmed copy of the original state, and there isn't one yet | The action is Reversible from saved state, and that copy is taken only when the action runs. |
| it isn't known yet whether the change can be undone | GraphnAI couldn't classify the action, so it takes the cautious ceiling. |
| the blast radius is larger than the analysis can count | The number of identities that would lose access passed the analysis limit. |
| some factors of the Operational Safety Metric couldn't be computed | The safety score is only partly measured, so the ceiling stays low. |
| the Operational Safety Metric couldn't be computed | There's no safety score for this action. |
| it isn't known yet which of this identity's permissions are in use | Use of this identity's access hasn't been checked yet. Automatic actions wait until it has. |
| this check found no permissions on this identity, direct or through its groups | An automatic action would have nothing to remove. |
| some of this identity's permissions, including those from its groups, have never been seen in use | Removing everything automatically could cut off access someone still needs. |
Full-Auto acts on its own only when every permission the identity holds, directly or through its groups, has been seen in use. A new deployment therefore starts with no identity eligible for Full-Auto. See Full-Auto Execution.
The badge is a ceiling set when the plan loads. When a Full-Auto action runs, it's checked again against the kill switch, the change window and the hourly limit. If one of those holds it, the receipt records the reason. The badge doesn't predict that outcome.
Actions in one plan can have different ceilings
Each action is judged on its own. In a Full-Auto plan, an action with a Full-Auto badge runs on its own, while a Tier 0 action in the same plan waits for you to authorize it.
Simulate-Only Sources
Some rows show a Simulate only badge instead of an autonomy badge. Hover it to read "This access can't be removed automatically." GraphnAI can model removing it, but has no directory write for it.
A Simulate only row isn't blocked by a safety check. A row held by a safety check has an autonomy badge (Safe Mode or Semi-Auto) and a reason, and you can still run it yourself. A Simulate only row has no automated way to remove that kind of access yet.
Examples include inherited access that can't be traced to a single source, and some delegation relationships.
An Active Directory permission set directly on an object isn't Simulate only. You remove it entry by entry, and its row shows no autonomy badge, because the ceiling is decided when the plan is compiled. See AD Permission Revocation.
Fleet Remediation
Not yet available. Fleet remediation would handle a group of identical findings, such as three stale servers with the same risky group membership, as one plan. Each identity would keep its own autonomy ceiling, and the hourly limit on automatic actions would apply across the group. The plan view exists, but no page opens it yet.
Recommendation Rationale in the Audit Log
Every action you run from Select Fire™ records a Decision Snapshot on its receipt in the Remediation page's History tab. Only Admins can see it. Under Why it was recommended, it records:
| Row | What it records |
|---|---|
| Main driver | The risk factor the engine named as the main driver for this identity |
| Confidence | The projection confidence when you authorized: Low, Medium or High. It's left out when the snapshot already shows Observation confidence. |
| Risk score with the recommended plan | The score before the plan and the engine's projected score after the recommended plan, both recorded as the engine gave them |
| The action list | Each recommended action, with a check mark if it ran. An action you added that the engine didn't recommend is marked "(not recommended)". |
| Factor values | The projected contribution of each risk factor after the plan |
To read it, select Detection & Response > Remediation, select a row, and find the Decision Snapshot section. Why it was recommended comes after the policy gates and the Operational Safety Metric factors.
The record can't be changed afterwards. Its values are stored as the risk engine gave them when you authorized, never recomputed later. Actions run before this record existed don't have the section, and the rest of their snapshot is unchanged.
What the record shows when you change the recommendation
If you clear a recommended action before you authorize, the action list shows it without a check mark. The record keeps the engine's full recommended set beside what you chose, so the difference stays auditable. The projected scores are the engine's own numbers for the recommended plan. GraphnAI never computes a score in the browser to write into the record.
Convergence: "Fix Upstream" Sources
Access you removed through Select Fire™ can come back after the removal was verified. The next time you open the Preview for that identity, its row shows a Fix upstream badge and the line "Came back after a verified removal."
A Fix upstream row isn't pre-selected and isn't added to the recommended plan. Removing it again would likely be undone by the same process, so fix what re-adds it instead.
When the change is undone, Operators and Admins get a "Change undone outside GraphnAI" notification. The same check watches every action you run, with nothing to set up.
GraphnAI sees that the access came back, but not what brought it back, whether a Group Policy, an HR sync or a person. Investigate your directory's provisioning to find the cause.
Troubleshooting
The risk narrative panel doesn't appear
The panel shows only to Admins, with a license that includes the AI features and remediation. It also needs a plan with at least one recommended change. Operators still see the plan, its autonomy badges and its headline.
If you're an Admin and the panel is missing, confirm an AI provider is set up on Admin > AI Provider.
The narrative shows a numbers-only summary
The AI provider was unavailable, timed out, or returned something that couldn't be read. The summary is built from the engine's numbers and is valid, so you can continue with the plan.
An autonomy badge shows Semi-Auto
Hover the badge for the reason. Common reasons:
- The target is Tier 0 or Tier 1. Check its classification in the Graph Explorer.
- Some of the identity's permissions haven't been seen in use yet. Nothing promotes them by hand: eligibility grows as telemetry sees real use. See Full-Auto Execution.
- The blast radius passed the analysis limit when the plan loaded. A narrower selection, such as the group membership instead of a broader resource, may give a smaller blast radius.
- The action is Reversible from saved state or Not reversible. See Remediation Reversibility and Undo.
The badge is a ceiling set when the plan loads. The kill switch or a change window can still hold a Full-Auto action when it runs. No governance setting raises a Semi-Auto ceiling to Full-Auto.
A row shows Simulate only
GraphnAI has no automated way to remove that kind of access. Remove it by hand with your directory tools. Simulate it anyway: the Simulate step shows the blast radius, so you know the impact before you act.
A row shows Fix upstream after you removed it once
The access came back after your removal was verified. Removing it again would likely end the same way. Check your provisioning, such as Group Policy or HR synchronization, to find what re-adds it, and fix it there.
To see when it came back, open the original removal's receipt in the History tab. Its Timeline shows when the directory confirmed the change and when it was changed back.
Comparing what was recommended with what ran
Open the receipt's Decision Snapshot and read Why it was recommended. The action list shows each recommended action, with a check mark for the ones that ran. The projected scores are the engine's numbers for the recommended plan, recorded as given.