Change Guardian

Before you patch a hospital server, see what it really breaks.

An AI agent that checks IT changes against what systems actually do.

Change Guardian is an AI agent. It compares what the hospital's IT records say with what its systems actually do, and warns you when a “safe” change isn't.

Try it yourself

Northwind Health is a fictional hospital system: 51 hospitals, 1,000 clinics and two data centres in seven western states. Every system, change, incident and user here is synthetic.

What patching dc1-host-07 breaks Emergency care contains H03 ED critical results, which uses the interface ORU-CRIT-H03. The records show no link from ORU-CRIT-H03 to the database lrc-db-01, so only lab reporting looks affected. The agent found the link in the interface engine configuration: lrc-db-01 runs on dc1-host-07, so patching it cuts off critical lab results to Emergency departments. found by the agent (interface engine config) Business serviceEmergency care Service offeringH03 ED critical results Interface (HL7)ORU-CRIT-H03 Databaselrc-db-01 ApplicationLab reporting Server, being patcheddc1-host-07

What the records say: only lab reporting is affected.

Hospital IT keeps a map. The map goes out of date.

Every hospital keeps a record of its systems and what depends on what, called a . People approving changes trust it. But systems change every week, and nobody updates the record. A patch that looks harmless on the map can break something nobody knew was connected.

On the map

one link missing

In reality

What the agent does

  1. Reads the records

    The : every system and the dependencies people wrote down.

  2. Checks the evidence

    10 discovery, monitoring and log sources show what systems actually do.

  3. Walks the graph

    Follows every dependency, many steps deep, in FalkorDB.

  4. Decides and acts

    Risk, who to warn, a note on the change, and a fix for a person to approve.

And it remembers what people approved or rejected, in its own .

  1. 1

    Read change request CHG-HEADLINE and what it targets get_change

    Apply ESXi security patch and reboot dc1-host-07

  2. 3

    Computed what breaks if dc1-host-07 fails (reality) radius

    107 components, 51 hospitals, 51 Emergency departments

  3. 4

    Looked for dependencies the evidence shows but the records lack hidden_links

    51 hidden links, seen by the interface engine

  4. 9

    Asked the change board to review CHG-HEADLINE request_cab_review

    Change board review requested

4 of 9 steps shown

High risk 51 hospitals affected, 51 hidden links

Watch it work

It chooses its own steps, one tool at a time, and says why. Every number in its answer is checked against the graph.

See the full investigation

Following dependencies is what graphs are built for.

In a 3.5-million-node CMDB, finding the 105,713 components that depend on one storage array takes 38 ms inside FalkorDB and 357 ms inside a tuned PostgreSQL. PostgreSQL is faster at the final reporting step, so for big changes the fastest design uses both.

All measurements

Proof and try it

Tested on 9 scenarios, 4 never seen during development: 7 correct.

About $0.002 per investigation.

All data is fictional; the code is open source.

Review a change Ask the agent Look under the hood