Simulation Feature

Differential State Engine™: Simulate Before You Act

Create delta overlays on the identity graph to model "what-if" scenarios, without touching production.

An admin sees a stale service account with Domain Admin rights. She knows it should be removed, but what if that account is the one keeping the payroll batch job running? So it stays. For three more years.

We've watched this play out at every organization we've talked to. The finding is clear. The fix is obvious, and nobody touches it because nobody can answer the question: what breaks?

Graph with edge selected and Simulate Revocation modal
Select any edge in the graph to simulate its removal before touching production.

How It Works

Model the change on a delta overlay. See who loses access. Check if anything breaks. Then decide.

Remove that service account from Domain Admins in the overlay. Instantly see every system, user, and application that depended on that membership. The Operational Safety Metric™ gives you a concrete number: how much operational surface area does this change touch?

Not sure which approach is safest? Run three scenarios side by side. Disable the account vs. remove the group membership vs. scope it down to just the SQL servers it actually needs. Compare the blast radius of each. Pick the one that fixes the risk without waking anyone up at 2 AM.

Delta overlays are lightweight differential filters on the existing graph. No cloning. No performance hit. Spin up as many as you need.

Simulation result showing affected nodes, Operational Safety metric, and revoked edge
Simulation result: affected nodes, Operational Safety metric, and the option to execute or reset.

Why This Matters

  • You answer "what breaks?" before you touch anything. That's the question that's been paralyzing your team.
  • The Operational Safety Metric™ turns gut feelings into a number you can take to change management
  • Run three different remediation strategies at once and pick the cleanest one
  • Nothing hits production until you say so. Simulations are read-only by design.
  • Change approvals accelerate from weeks to hours when you bring blast-radius data instead of gut feelings.

Dig into the mechanics in our Identity Graph docs.

Request Early Access