Concepts

This page is the mental model. Every other page in these docs builds on it.

Graph#

A graph is a versioned definition of an agent workflow: nodes connected by edges. Everything that runs in Orkena is a graph. Graphs are authored on the visual canvas or in the graph DSL — the two are code-parity surfaces for the same definition.

Node#

A node is one step in a graph: an agent call, a tool invocation, a transform, a router, a gate, a human task, a wait, a memory read or write. There are 19 node types; see Nodes.

Edge#

An edge connects two nodes and carries the data that flows between them. Every edge traversal is a policy decision point.

Run#

A run is one execution of a graph, from trigger to terminal node. Runs are durable state machines: every step is checkpointed, and a run can pause at a human approval for weeks without holding compute.

Gate#

A gate is a node that pauses execution pending an approval (or an evaluation, or a policy verdict). gate.hitl opens a human approval with quorum, SLA and escalation; gate.policy runs a policy check; gate.eval runs an evaluation suite.

Policy#

A policy is a pack of authorization rules written in Cedar — the AWS-published authorization language — evaluated in-process by Cedar’s Rust evaluator via cedarpy against every proposed action. Verdicts are permit, deny, or hold. See Policy packs.

Ledger#

The ledger is the per-tenant, append-only, hash-chained record of every authorization, execution, approval and administrative action. Each entry carries the hash of the one before it; the chain head is periodically signed with an Ed25519 anchor. See The hash-chained ledger.

Evidence bundle#

An evidence bundle is a signed archive exporting a slice of the ledger plus anchors, public key, a readable report, and the dependency-free verify.py verifier. Your auditor runs it on their own machine, offline. See Evidence bundles.

Memory#

Memory is the cross-run store of what agents learned. Consolidation merges duplicates, surfaces contradictions and proposes rule refinements — nothing activates without a human veto window and an eval gate. See Memory consolidation, Evaluation suites, and the memory section of the technical brief.

Tenants and workspaces#

A tenant is an isolated organization. A workspace is a scoped area within a tenant — one graph, one policy pack set. Workspaces are isolated per-tenant with row-level security and a per-tenant hash chain.