PUBLIC DEMO · SAFE REPLAY · PLAIN ENGLISH

DataHub grounds the plan. Deterministic policy seals exactly what may run.

Agentic loop: sense with DataHub tools → LLM plans allowlisted tool calls → non-model gate seals the exact plan → adapters run → receipt back to DataHub. AI proposes; AI does not authorize.

scroll to walk the pipeline

INCIDENT TRIGGER · SOURCE ASSERTION

Revenue dashboard freshness breach after payments model deploy

payments_daily exceeded its recorded 15 minute freshness SLO. 23 minutes observed against 15 minutes.

SERVICEpayments-analytics OWNEROn-call data platform DETECTED2026-07-31T03:06:18Z STATUSawaiting authorization

01 · DATAHUB CONTEXT

Grounded entity & blast radius

grounded

PRIMARY ENTITY analytics.payments_daily urn:li:dataset:(urn:li:dataPlatform:snowflake,analytics.payments_daily,PROD)

Owner: Data Platform
Domain: Revenue Intelligence
Tier: Tier 1
Platform: Snowflake

8 recorded downstream assets

3 Tier 1 dependencies

AUTHORIZATION BOUNDARY bounded metadata-derived, not causal proof

Asset Type Criticality Relationship

finance.revenue_executive Dashboard Tier 1 1 hop downstream

risk.payment_anomaly_features Feature table Tier 1 2 hops downstream

growth.checkout_health Dashboard Tier 1 2 hops downstream

finance.daily_close_packet Report Tier 2 3 hops downstream

RECORDED EVIDENCE 3 provenance pointers

Unknowns stay unknown. Query logs outside the fixture window are not represented. Lineage proximity does not establish user-visible impact.

02 · PLANNER OUTPUT

Bounded response plan

PLAN FINGERPRINT


                    20f3ace20273830b

OBJECTIVE Coordinate bounded response work without asserting unproven causality.

Collaboration fanout and metadata write-back only

01

Open an auditable incident work item reversible

Preserve owner, evidence pointers, and remediation checklist.

github.issue.create → data-platform/operations
02

Notify the bounded incident channel reversible

Publish the known facts, unknowns, and current authorization scope.

slack.message.post → #inc-data-platform
03

Attach provenance context to the active page reversible

Give the on-call responder DataHub entity and blast-radius pointers.

pagerduty.incident.note → PD-INC-PAYMENTS-778
04

Create the follow-up recovery task reversible

Track freshness recovery and post-incident verification separately.

jira.issue.create → DATAOPS
05

Write the bounded response receipt to DataHub reversible

Keep the entity, action receipts, unknowns, and next owner together.

datahub.incident.writeback → analytics.payments_daily

EXECUTION BOUNDARY No production rollback or incident resolution is authorized by this plan.

DISAGREE WITH THIS PLAN?

Pick a smaller alternate — same safety lock, new seal

You are not stuck on deny. Swap the AI draft for a human template (or keep the full fanout). Any prior authorization is wiped; the new plan must pass the same deterministic gate before anything runs.

05 · ACTION FANOUT

Provider execution receipts

0 / 4 receipted

GH held

GitHub

Create incident issue data-platform/operations

Waiting for deterministic authorization.

Receipt pending authorization

SL held

Slack

Post bounded incident brief #inc-data-platform

Waiting for deterministic authorization.

Receipt pending authorization

PD held

PagerDuty

Append incident note PD-INC-PAYMENTS-778

Waiting for deterministic authorization.

Receipt pending authorization

JR held

Jira

Create recovery task DATAOPS

Waiting for deterministic authorization.

Receipt pending authorization

06 · DATAHUB WRITE-BACK

Incident coordination receipt

held

ENTITY analytics.payments_daily

No DataHub write-back has occurred.

No write-back receipt recorded

Operation: DataHub incident receipt UPSERT
Aspect: not reported
Recorded: not recorded

07 · INHERITED MEMORY

What the next agent receives

draft

NEXT AGENT Recovery verifier

Fanout and write-back have not executed.

Known facts

A fixture freshness assertion is outside its recorded threshold.
The fixture graph contains eight downstream assets.

Still unknown

Root cause is not established.
End-user impact is not established.

Next safe actions

Obtain deterministic authorization for the bounded fanout.
After execution, verify provider and DataHub receipts.

03 · AI VERIFIER

Advisory review

PASS WITH BOUNDS

The proposed fanout is reversible and grounded in recorded metadata. The verifier did not establish deploy causality or production impact.

Evidence classes remain separated
Source assertions are not relabeled as DataHub-verified facts.
Unknowns are preserved
Causality and user-visible impact remain explicitly unknown.
Action scope is reversible
The plan creates or annotates records; it does not mutate production.
Claim ceiling is intact
The plan makes no validation, uplift, promotion, or AGI claim.

OUTPUT ORIGIN replayed verifier output

04 · DETERMINISTIC GATE

Authorization

pending

AI cannot open this gate. Every structured policy check and the exact plan-bound confirmation must pass.

DataHub context is grounded The backend must identify grounded context instead of inferred context.
Blast radius is bounded Unknown or unbounded dependency scope closes the gate.
Plan fingerprint is intact The reported and computed plan fingerprints must agree.
Every action is allowlisted and reversible This dashboard only authorizes collaboration records and metadata write-back.
Verifier policy checks are complete Structured checks are required; AI prose is advisory and cannot authorize.
Actor identity supplied A named operator must own the authorization receipt.
Exact plan hash supplied The request must bind to the current computed plan fingerprint.
Exact confirmation phrase supplied The incident ID and plan fingerprint must be typed exactly.
Claim boundary acknowledged Authorization does not validate causality, impact, recovery, or AGI.

AUDIT TIMELINE

Decision trace

03:09:04
Verifier completed
Advisory output passed with explicit causality bounds.
AI advisory
03:08:10
Plan proposed
Reversible collaboration and write-back actions prepared.
deterministic policy
03:07:02
Context grounded
Ownership, tier, and downstream lineage loaded from fixture metadata.
DataHub metadata
03:06:18
Trigger observed
Freshness assertion crossed its recorded threshold.
source assertion

CLAIM BOUNDARY · ALWAYS ON

Operational metadata, planner proposals, and receipts are not proof of causality.

LedgerLens separates source assertions, DataHub metadata, deterministic policy decisions, AI advisory output, executed action receipts, and unknowns.