Writing · Lens · Investigation · 21 October 2026 · 2 min read

How is A connected to B? Trace mode on the investigation canvas

Investigations start with a question of connection. Answering it means joining across systems that were never designed to join, then explaining the path to someone who will challenge it. Trace mode walks the estate graph and shows every hop with its evidence.

An investigation rarely begins with a record. It begins with a question of connection. How does this supplier relate to that director? How did this claim reach that account? Which of these three customers is the same person, and since when? The answer lives across systems that were never designed to be joined, and once found it has to be explained to someone whose job is to doubt it.

The canvas

Lens gives an investigator a canvas: a saved, multi-record graph workspace. Records, systems and people are nodes; provenance, ownership and relationships are edges. Expand a node by edge to see what it touches. Pin what matters. Switch to the geo view when the question is about place, or open the timeline drawer when it is about sequence. Attach the canvas to a case, so the investigation travels with the decision it leads to rather than living in someone's screenshots.

Trace mode

Trace mode is the direct form of the question. Pick two nodes and Lens walks the estate graph between them, every hop shown, each with the evidence behind it: the merge that joined two records, the source that supplied an address, the policy that governs the system in the middle. The path is not a suggestion. It is a sequence of governed facts, each one on the ledger.

That is what makes the answer defensible. "They are connected" becomes "they are connected through these five hops, and here is the evidence for each".

The action graph

Investigations lead to actions, and actions have consequences. The action graph shows every executed action as a node: what it changed, what it was approved against, and what it set off next. When a remediation triggers a downstream export or a merge triggers a re-score, the chain of cause is visible rather than inferred.

Detect, decide, act, prove

The canvas sits inside a loop. Rule violations paint the canvas so the investigator sees where the estate is out of policy. An action-first panel proposes the fix. A person approves it. The evidence chain records it. The investigation, the decision and the proof are one object, which is the only form in which an investigation survives contact with an audit.

See it on your data

Reading is the slow way to find out.

A 45-minute demo or a 14-day guided trial, run with our team on your own sources.