Compliance is a constraint, not a feature.

“Which patient fields was a user refused, and when?”

Patient.ssn declared with acl: { read: ["compliance_officer"] } returns Null for an analyst’s MATCH (p:Patient) RETURN p.ssn. The engine enforces this, not the application. Each read denied in Cypher is appended to the graph’s ACL event log. db.aclEvents replays it; db.verifyAclChain() reports whether any event was altered.

“Patient asks us to erase their data.”

Crypto-shred (per-subject encryption keys and key destruction) is in development. Contact us before relying on it for erasure requests.

“What did the patient’s chart say on the day of treatment?”

MATCH (p:Patient {mrn: 'M12345'})
  AT VALID    '2024-03-15'
  AT RECORDED '2024-03-15'
RETURN p

AT VALID asks “what was clinically true that day?” AT RECORDED asks “what was in the chart that day?” The two differ when a result was entered later with an earlier effective date.

Research data sharing with noised aggregates.

Issue a research collaborator an API key with privacyMode: {epsilon_budget: 1.0, period: "Daily", max_per_query: 0.1}. With that key, only expressions built on count, sum or avg may be returned; noise is added and each aggregate spends from the key’s ε budget. A hash-chained private-mode event log (db.dpEvents, verified with db.dpVerifyChain()) gives the IRB a record of each aggregate and its ε spend. This release does not give a differential-privacy guarantee; do not rely on private mode alone to protect individual records.

“Reconstruct the trader’s view at 14:32:17.4”

AT RECORDED '2024-10-15T14:32:17.4Z' on a MATCH clause reads the graph as the database held it at that instant. The same query with the same AT RECORDED timestamp reads the same recorded history each time it is run, as long as that history is retained.

“Show that these trade records were not modified after submission.”

No API turns WORM mode off once it is engaged. Updates and deletes sent through Cypher, MCP tools, /execute and import are refused; creates are accepted. It does not cover the legacy POST /write route on the default graph, schema or index changes, or an administrator dropping the whole graph. Engaging it requires an Enterprise license. InvariantDB does not claim that WORM mode by itself meets SEC 17a-4(f); that is an assessment of your whole record-keeping system. Each node and relationship write committed through Cypher, /execute or import is appended to the graph’s history log with the SHA-256 hash of the previous record. Schema, index and constraint changes and writes sent to the legacy POST /write route are not recorded. GET /graphs/{name}/audit/verify re-hashes the log and returns clean or the first broken record. The history log is not signed or anchored outside the server, so the check does not detect a rewrite of the whole log, or removal of the most recent records, by someone with write access to the server.

“Where did this credit decision come from?”

MATCH (a:Application {id: $appId})
CALL db.propertyProvenance(id(a), 'approved')
YIELD value, validFrom, version, txnAt,
      actor, source, reason, confidence, principal
RETURN value, actor, source, reason,
       confidence, principal, validFrom
ORDER BY version DESC

Each property version written with a provenance envelope records who made the change, the source, the reason, and the confidence; the engine adds the authenticated credential as principal. Versions written without an envelope return null in the columns the caller supplies; from 1.4.2 principal is recorded for them too when the request was authenticated. The same walk supports adverse-action explanations and model-risk reviews.

“Quants want to compute portfolio statistics on real data.”

A research API key in private mode may return only expressions built on count, sum or avg; noise is added and each aggregate spends from the key’s ε budget. This release does not give a differential-privacy guarantee. Do not rely on private mode alone to protect individual records.

“Show the policy + coverage + claim graph as of the loss date.”

For a rate-filing review, MATCH (p:Policy)-[:HAS_COVERAGE]->(c) AT VALID '<filing-effective-date>' AT RECORDED '<filing-date>' RETURN … reads the policy and coverage graph as it was valid on the effective date and as it was recorded when the filing was prepared, weeks or years later. No ETL pipeline or separate archive is needed.

“Adjuster changed a reserve estimate. What was it before?”

MATCH (r:Reserve {id: $reserveId})
CALL db.propertyHistory(id(r), 'amount')
YIELD value, validFrom, validTo, version, txnAt
RETURN version, txnAt, validFrom, validTo, value
ORDER BY version

“Underwriting bound a risk. Who approved? What was the basis?”

A binding write can carry actor, source (model run id, or underwriter login), reason and confidence in its provenance envelope; the engine records the authenticated credential (for a capability token, capability:<principal>) as principal. Capability tokens give each underwriter their own time-limited credential. NAIC Model Audit Rule § 6 requires controls testing; the provenance log and the hash-chained history are evidence you can hand to the tester.

“Carrier sharing claim statistics with a state DOI.”

Issue the state’s data partner an API key with privacyMode configured. With that key, only expressions built on count, sum or avg may be returned; noise is added and each aggregate spends from the key’s ε budget. This release does not give a differential-privacy guarantee; do not rely on private mode alone to protect individual claimant records.

“Where is this graph stored?”

A graph is stored in the region of the deployment that hosts it. The hosted service stores graphs in the United States. Residency choices are not available.

“Which credential was refused access to which property?”

Mint a capability token for the agent’s principal with a read or write scope and a short expiry (up to 5 minutes by default). Cypher reads that a field ACL denies and node creates it refuses under that token are appended to the ACL event log with the principal, label, property and reason; db.verifyAclChain() reports the first event whose hash no longer matches.

“Suspect-data crypto-shred at end of authorized retention.”

Crypto-shred (per-subject encryption keys and key destruction) is in development. Contact us before relying on it for erasure requests.

Compute noised statistics over sensitive registries under an ε budget.

As in the healthcare and finance sections: with a private-mode key, only expressions built on count, sum or avg may be returned; noise is added and each aggregate spends from the key’s ε budget. This release does not give a differential-privacy guarantee; do not rely on private mode alone to protect individual records.