Structured Intelligence for Agentic Reasoning
From Ontology-Derived Knowledge Graphs to Graph RAG Powered Neuro-Symbolic AI
Today's AI systems give answers without accountability. When a black box model tells an executive that a project will slip three weeks, there is no way to ask why, no way to trace the claim back to the underlying records, and no way to know whether the answer came from real data or from a plausible sounding guess. For an institution like a Bank, where decisions carry regulatory, financial, and reputational weight, that opacity is not a minor inconvenience, it is a structural risk. Glass Box exists to prove there is another way. Every answer it produces is computed from a live digital twin of real project data, and every figure can be clicked through to the raw evidence rows and the audit trail that produced it. The system attributes causes rather than asserting them, simulates scenarios without ever touching the underlying record, and, critically, refuses to answer when the data cannot support an answer, instead of inventing one. The goal is not to make AI sound more confident. It is to make AI accountable: transparent in its reasoning, grounded in its evidence, and honest about its limits.
A confident answer you can't trace is a liability
Every reporting tool you've been shown answers fluently. Dashboards summarize, copilots narrate, and when the number is wrong there is no way to know whether it was computed or invented. The moment an auditor, a regulator, or the board asks how a decision was made, fluency is worth nothing. Lineage is everything.
This is not a small gap to close with a better prompt or a stricter review step. It is a structural property of how most of these systems are built. A language model, asked "why is this late," will produce an answer whether or not it actually has access to the events that caused the delay. It cannot tell you which case you are in, because from the inside, a fabricated answer and a grounded one look identical. The fix has to be architectural, not procedural.
What a language model computes
A large language model is an autoregressive probability distribution. That single line explains both its power and its ceiling. It is a model of how language continues, trained to maximise the likelihood of plausible text, not the truth of asserted facts.
What your business requires
There is no variable inside a transformer that represents "whether this approval was granted" or "who is double-booked this week." When you deploy an LLM as a decision engine, you are asking a model of linguistic plausibility to do the job of a model of the world. The eloquence is real. The world model is not.
Four commitments, not features
Answers come from deterministic engines running over real, dated events. The language model never decides, it only narrates a result the math has already produced. Ask the same question of the same data twice; you get the same answer, twice.
Watch this happen under Deep Analysis, in the menu above.
If no verb exists to answer a question, the system says so and stops. No verb, no evidence, no guess. An honest refusal is what makes every answer it does give worth trusting.
Try an unanswerable question yourself under Deep Analysis, in the menu above.
Any figure in any answer resolves, in one click, to the raw event row behind it, stamped with both clocks: valid_time, when it became true in the world, and tx_time, when the system learned it.
The evidence rail is one click away from any figure, under Deep Analysis.
The system only recognizes entities and relationships that have been explicitly defined and validated ahead of time: milestones, approvals, people, dependencies, and a fixed set of ways they can relate. A language model can talk about anything. This system can only reason about what has actually been formally described to it. That constraint is the entire reason it can be audited at all.
The full ontology and its validation rules are under Architecture, in the menu above.
Agency multiplies error. Scale cannot repeal the exponent
A chatbot makes one probabilistic call per answer. An agent makes a chain of them: parse the goal, plan the steps, call the tools, interpret the results, act again. If each step succeeds independently with probability p, the probability the whole chain succeeds is pn. This is the single most important formula in agentic AI, and almost nobody selling agents will put it on a slide.
| Per-step reliability | Steps in workflow | End-to-end success |
|---|---|---|
| 95% | 10 | ≈ 60% |
| 95% | 20 | ≈ 36% |
| 99% | 50 | ≈ 61% |
| 99% | 100 | ≈ 37% |
The only architectures that escape this law are the ones that change the failure algebra itself: verify each step against ground truth, catch the error at the step where it occurs, and correct or escalate before it propagates. That is precisely what a symbolic verification layer does, and it is why this architecture is not a preference, it is the mathematically required response.
An LLM agent with database tools is not the same claim as this
The fastest way to build something that looks like this is to give a capable language model a set of MCP tools that query your relational databases directly, and let it reason its way to an answer. It is also, on its own, the wrong foundation for a decision a bank has to stand behind. Here is the actual argument, not the marketing version.
Retrieval grounds the prompt. It does not ground the arithmetic.
Pulling rows back from Postgres over MCP proves the agent looked at real data. It does not prove the number in its final answer was actually derived from those rows rather than pattern-completed alongside them. A model can retrieve the correct approval date and still state the wrong delay, because the retrieval step and the reasoning step are not the same operation, and only one of them is verifiable after the fact.
Raw relational schemas were never meant to carry meaning.
A foreign key tells you two rows are related. It does not tell you whether that relationship means "gates," "depends on," or "was assigned by," and an LLM asked to infer the semantics of an unfamiliar schema on the fly will guess, confidently, based on column names and comments. That is exactly the hallucination surface: the model is not inventing facts so much as inventing meaning for facts that were never disambiguated to begin with.
Multi-hop joins compound the error at every step.
A forensics question like this one is rarely a single lookup, it is a chain: find the gating approval, find its actual grant date, find overlapping resource assignments, difference against plan. An agent composing that chain live, one tool call at a time, can make a small misjudgment at any hop, and that error propagates silently into every step downstream of it. There is no checkpoint where the chain is validated as a whole before the answer is delivered.
Non-determinism is invisible until two people compare notes.
Two executives asking the same question in two separate sessions can get two different numbers from an agentic pipeline, because sampling, tool-call ordering, and context-window contents all vary run to run. Nobody notices until the discrepancy surfaces in a meeting, at which point the question becomes which answer, if either, was correct, and there is no principled way to tell.
A single autoregressive step cannot certify its own correctness.
Language models have no mechanism to internally verify a computed result before emitting it; generation and verification are the same forward pass. A model can produce fluent, structured, wrong reasoning with exactly the same confidence as fluent, structured, right reasoning. Confidence, as expressed in token probabilities, is not calibrated to correctness on multi-step arithmetic and schedule logic.
An unbounded tool surface is an unbounded attack and error surface.
An agent with broad MCP access to raw databases can, in principle, be steered by a cleverly worded question, a poisoned record, or an ambiguous instruction into running a query nobody intended, and nothing in the architecture stops it from trying. A read-only, narrowly typed verb layer cannot be steered into an action it was never given, because the action was never wired up in the first place.
The agentic pattern is not wrong to use, it is wrong to trust as the only layer between a question and a number that matters. This system keeps the language model exactly where it is reliable: turning a computed, structured result into a sentence, and removes it entirely from the two places it is unreliable: deciding what the answer is, and deciding how to get there. The reasoning that produces the number is a hand-written, tested, version-controlled function, not a live chain of tool calls a model improvises per question.
Peak demand, built on post-trough foundations
Gartner's 2025 Hype Cycle makes a startling statement, if you read it as a risk map rather than a trend report. AI Agents sit at the very top of the Peak of Inflated Expectations: maximum budget, maximum hype, maximum distance from verified evidence. Knowledge Graphs sit on the Slope of Enlightenment: hype wrung out, capability confirmed. The market's loudest promise is at maximum decoupling from evidence at the exact moment its quietest foundation has finished paying the trough's tuition.
We sell into peak demand while carrying post-trough delivery risk.
The demand we serve, AI Agents, sits at the peak, which means budgets, urgency, and board attention are at their maximum. But the foundation we build on, knowledge graphs, formal ontologies, symbolic reasoning, sits on the far side of the trough, where hype has already been wrung out and what remains is verified capability.
Every wrapper vendor in the room is the inverse: they sell into the same peak demand while building on components that are themselves still descending. When the agentic trough arrives, and Gartner has effectively scheduled it, projecting over 40% of agentic projects cancelled by end of 2027, the vendors who survive will be the ones whose foundations already survived a trough of their own.
The industry is disappointed in GenAI's reliability, so it gave it more responsibility.
Generative AI and Foundation Models are descending into and through the Trough of Disillusionment in 2025. The agentic peak is being built on top of a substrate the market is simultaneously souring on: a new peak of expectations stacked directly on top of an active disillusionment.
The honest response is not to give the technology more responsibility. It is to give it more structure.
The trough is not our risk. The trough is our habitat.
The Trough of Disillusionment is where procurement changes character: demos stop working, proof starts mattering, and the buyer's question shifts from "what could this do?" to "what can you verify it does?"
Every element of this positioning, publishable results, deterministic reasoning, constraint-violation rates, provenance coverage, is the evidentiary standard that trough-era procurement demands and peak-era vendors cannot meet. Hype cycles do not kill categories; they kill claims that cannot survive measurement.
This is not a hypothetical risk. It is a recurring one
A steering committee acts on a number nobody can trace.
A status report says a milestone is "on track, minor risk." Three weeks later it slips. When the committee asks why the earlier report didn't say so, the honest answer is that the report summarized a feeling, not a computation. Nobody can point to the record that changed.
An auditor asks what was known, and when.
Regulatory reviews do not ask "what is true now." They ask what your organization believed on a specific date, and whether that belief was reasonable given what was knowable then. Most systems only hold today's state. Reconstructing a past belief means reconstructing it from memory, email threads, and whoever is still employed.
A capacity decision is made on a gut feel about headcount.
"Can we take on Open Banking this quarter" gets answered in a meeting, by whoever speaks last, based on whoever they happened to talk to that week. The actual allocation data, who is assigned to what, at what percentage, already exists somewhere. It is rarely the thing consulted.
A model gives a fluent answer to a question it cannot actually compute.
Modern language models are extremely good at sounding certain. That is precisely the failure mode a bank cannot afford: a plausible-sounding number, delivered with total confidence, that was never actually computed from a record. Fluency and correctness are different properties, and most tools only optimise for the first.
Model risk review has nothing to validate against.
If the reasoning path from question to answer cannot be inspected, it cannot be signed off on by the people whose job is to sign off on model risk. A black box that happens to be right most of the time is not a control, it is an unmanaged exposure with a good track record so far.
Every fix becomes a new prompt, not a new rule.
When a pure language-model system gets a wrong answer, the usual remedy is to adjust the prompt or add a few more examples. That does not generalise, and it does not leave behind anything an engineer can point to later as the rule that was applied. A computed system fixes the underlying function once, and every future answer inherits the fix.
Each of these is avoidable, not by writing better prompts, but by changing what is allowed to answer a question in the first place.
Four capabilities, one underlying system
Everything below runs on the same computed, evidenced, refusal-capable core. The difference between them is only the question being asked and the depth of the answer, not the trust model.
Why is it late, and what would have prevented it.
Given a milestone, the system walks the actual chain of gating approvals, resource assignments, and dependency events that produced its current schedule position, then computes a counterfactual: what the schedule would look like if one factor had gone differently. This is the flagship path, and the one that runs end to end today.
The chain is not a narrative written by a model, it is a sequence of real record lookups: find the gating approval, find its actual grant date, find any overlapping resource assignments in the same window, and difference the result against the plan. Every step is a query against stored events, not a token generated to sound plausible.
Every project the twin knows, honestly labeled.
A live view across the full portfolio, not a single milestone. Every KPI shown is computed on demand from current records rather than pre-baked into a report, and every project card is labeled by how much of it is actually wired into the twin, rather than implying uniform coverage that does not yet exist.
This labeling is deliberate and enforced at the data layer: a project only appears as fully covered once its entities and relationships pass validation against the ontology below. Partial coverage is shown as partial, not smoothed over. A dashboard that cannot admit its own gaps is not trustworthy in the places where it happens to be complete either.
What did we know, as of a specific date.
Because every fact in the system is stamped with both the moment it became true in the world and the moment the system learned it, any past state of belief can be reconstructed exactly. Ask what was known on January 15th, and the answer reflects only what had been recorded by that date. Nothing learned afterward leaks backward into it.
Mechanically, this is a filtered query over the event log: every fact is retained forever, never overwritten, and the query simply excludes anything whose transaction time is later than the as-of date requested. Nothing is deleted or rewritten to make history look cleaner than it was.
Every layer, inspectable, for the people who have to sign off on it.
A full, seven-layer breakdown, from the frozen ontology at the bottom to the executive surface at the top, with the specific open-source tool behind each layer and the exact path a question travels through them. This is written for architects and risk teams who need to evaluate the system on its engineering merits, not take it on faith.
Concretely: a hand-authored RDF/OWL ontology validated with SHACL shapes, a bitemporal event store queried directly, a deterministic Python reasoning function per question type, one typed MCP tool exposing it, a narrow intent match from question to tool, and a narration pass that only summarizes what the tool already returned. Every hop writes to a provenance log as a side effect, not as an afterthought.
"Why is the payments milestone late?"
The go-live for m_204 slipped by , about three weeks. The gating security approval a_88 sat idle for before it was granted, and once cleared, the two people who hold the required integration skill were both already committed to another task through May 4, pushing the earliest feasible start to May 5. Counterfactual: had the approval cleared immediately on its creation date, the milestone .
Slip is computed as the gap between these two dates, not stored as a field anywhere.
idle_days is derived at query time from these two events, never stored as a static field.
This exact question, live, is under Deep Analysis in the menu above.
"What did we know about payments as of January 15th?"
As of 2026-01-15, the twin's records showed the gating security approval a_88 as , and zero risks logged against the milestone. The approval had not yet cleared, and the resource contention that ultimately pushed the earliest feasible start to May 5th had not yet occurred, because neither event had happened yet. This is not a summary written after the fact. It is the actual state of belief on January 15th, reconstructed from the record as it stood then.
Nothing recorded after January 15th is allowed to leak backward into this answer. That is what makes it a reconstruction of belief, not a rewritten history.
This exact question, live, is under Portfolio Q&A in the menu above.
Designed to survive the audit, not just the demo
Every question ever asked of the system is permanently logged, who asked, which verb answered, when. Not the answers you choose to keep. Every question, by anyone.
The log itself is append-only and structured, not free text: actor, verb, inputs, outputs, and a timestamp, written as a side effect of the call, not as a separate step someone can forget to run.
Every fact carries two clocks, valid_time and tx_time. Any past state of knowledge can be reconstructed exactly, which is the literal shape of the question a regulator asks: what did you know, and when did you know it.
This is a bitemporal data model, not a version history bolted on after the fact. Facts are never overwritten or deleted; a correction is a new row with a later tx_time, so the record of what the system believed at any past moment is preserved exactly as it was believed, errors included.
The reasoning layer is deterministic. The same question against the same data yields the same answer, every time. There is no temperature, no sampling, no "it depends" in the math.
The language model's only job is narration: converting a structured result into a sentence. Swap the narration model entirely and the computed answer, the chain, the counterfactual, does not change. That separation is what makes the answer independently checkable by someone who does not trust language models at all.
Every fact is checked against a fixed schema before it is trusted. The ontology defines the allowed classes, relationships, and shapes in advance, and incoming data is validated against those shapes before it can be reasoned over.
This is enforced with SHACL, a W3C standard for validating graph data, not an internal convention that depends on every engineer remembering to check. Data that does not conform is rejected at the boundary; it never reaches the reasoning layer in a shape the system was not designed to handle.
The verb layer is the only surface that can act, and it is narrow by design. Each verb declares exactly what it reads and what, if anything, it can write. Read-only questions and any future action that changes real data are architecturally distinct categories.
No verb in the current system writes to anything. The moment a write-capable verb exists, a human sign-off gate sits in front of it by construction, not by policy that can be skipped under pressure.
The questions a hostile CTO will ask
Every one of these has been asked. None of them invalidates the architecture. Here is the actual argument, not the marketing version.
Scale raises per-step reliability; it cannot repeal the exponent. Ninety-nine percent per step across a hundred-step workflow is still roughly 37% end to end, and no amount of scale converts a prompt (a suggestion) into a constraint (a guarantee), nor conjures provenance from a probability distribution. The strongest evidence is the labs' own behavior: they keep bolting symbolic machinery (tool use, code execution, structured outputs, retrieval) onto their models. If scale alone solved it, they would not need to.
They did, before the technology that now accelerates them. Neural extraction with expert validation has collapsed construction timelines, and the rollout is incremental: one high-value domain first. More importantly, compare asset classes: a prompt library is replicable by any competitor in days; the graph appreciates with every use and its switching costs work for you, not for a model vendor. The irony worth stating aloud: LLMs' greatest enterprise contribution may be making it cheap to build the structures that discipline LLMs.
RAG retrieves text chunks by similarity and hopes the model reads them correctly: single-hop lookup, no constraints, no reasoning, no guarantees. This architecture traverses typed relationships across multiple hops, validates every proposed action against formal rules before execution, and returns answers with provenance attached. One is a better search box. The other is a system of record that can act. The difference is not a matter of degree; it is architectural category.
It failed at perception, at the knowledge-acquisition bottleneck, and at brittleness on messy input: the three problems neural networks definitively solved. The hybrid keeps the proofs and adds the perception; each paradigm covers exactly the other's collapse mode. DeepMind's AlphaGeometry paired a neural model with a symbolic deduction engine and solved Olympiad geometry problems at near gold-medal level (Nature, 2024). The systems that actually achieved verified machine reasoning at the frontier are neuro-symbolic. That is the published record, not our marketing.
First correct the metric: the unit of value is not tokens generated but tasks completed, verified, and safe to automate, cost per verified outcome, including risk. Then look at the graveyard: MIT's 2025 finding that roughly 95% of enterprise GenAI pilots produced no measurable P&L impact; Gartner's projection that 40%+ of agentic projects will be cancelled by 2027. Pilots die at the same wall every time: no auditor, no insurer, no compliance officer will sign off on unverifiable behavior. Verification is not overhead on the ROI. Verification is what unlocks it, because it is what lets automation move from demo to production.
Brittleness and auditability are in direct tension: there is no free lunch here, and any system that claims otherwise is hiding the brittleness somewhere else. What the ontology boundary actually does is make brittleness visible and locatable: when a new entity type is needed, the system refuses and says so, rather than improvising an answer that feels right but carries no guarantee. The alternative, an open-ended model that handles anything, does not eliminate the boundary, it just moves it somewhere you cannot inspect. A known, documented constraint is preferable to an unknown one.
What runs end to end today: all five verbs, attribute_delay, run_scheduler, reconstruct_asof, simulate_scenario, and the honest refusal path, each one a deterministic engine, each one evidenced to the raw row. Every answer in this deck is live, computed against the deployed digital twin at the moment you read it, not a script written to look convincing.
Each of the five was proven end to end, stress-tested, and only then followed by the next, one path at a time rather than five shallow paths shipped at once. The full reasoning for that build order, and every layer's specific technology choice, is documented in the Architecture page in the menu above.
The fastest way to be dismissed as another AI vendor is to claim this approach is necessary everywhere. It is not. Where stakes are low and a human reviews every output, drafting, summarisation, internal search, a plain language model is cheap, fast, and sufficient. Say so without hesitation. Structured intelligence becomes mandatory at a specific, nameable boundary.
Where a plain LLM is sufficient
- Drafting, summarisation, and internal search where a human reviews every output
- Brainstorming and ideation where being approximately right is acceptable
- Content generation where errors are recoverable and low-stakes
- Single-turn Q&A with no downstream autonomous action
Where this architecture is required
- The system acts autonomously: no human reviews before execution
- Outputs carry financial, legal, or regulatory consequence
- The workflow chains enough steps for the compounding law to bite
- An auditor, regulator, or insurer must be able to sign off on the reasoning