SELECT * FROM logs WHERE severity = 'high';

SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact, rollback_plan, approval_required

COMMAND target
WHERE conditions
WITH options
SHOW fields
ORDER BY field DESC
LIMIT number
AS view

FIND cybercells
WHERE risk_score >= 90
AND evidence_status != "verified"
SHOW name, type, owner, risk_score, evidence_status, attack_paths
ORDER BY risk_score DESC
LIMIT 20
AS table

TRACE identity "[email protected]"
TO database "customer-db-primary"
VIA credentials, sessions, network_paths
SHOW path, hops, risk_score, evidence

REPLAY incident "INC-2026-0042"
FROM first_seen
TO contained
SHOW timeline, graph, evidence, ai_decisions, kinetic_actions
AS timeline

SIMULATE action "rotate-credential"
ON credential "svc-payments-token"
WITH max_business_impact = "low"
SHOW risk_delta, affected_services, rollback_plan, approval_required
AS simulation

Asset("prod-api-07")
Identity("[email protected]")
Database("customer-db-primary")
Credential("svc-payments-token")
Incident("INC-2026-0042")
Evidence("EV-7781")
Memory("MEM-9201")
Policy("POL-AI-003")
Action("ACT-1044")
Key("KEY-ZELEN-01")
Agent("Aina SOC Agent")
CrownJewel("Customer Production Database")
BusinessService("Customer Portal")
Tenant("Rocheston Demo")

asset "prod-api-07"
identity "[email protected]"
incident "INC-2026-0042"
evidence "EV-7781"
memory "MEM-9201"
policy "POL-AI-003"

FIND cybercells WHERE risk_score > 80

find cybercells where risk_score > 80

-- Find dangerous production CyberCells
FIND cybercells
WHERE risk_score > 85
AND zone = "production"
SHOW evidence, attack_paths, blast_radius

/*
This query identifies AI-visible critical assets
that may require policy tightening.
*/
FIND cybercells
WHERE sensitivity = "critical"
AND ai_visibility = "allowed"
SHOW policy_status, evidence_status

"prod-api-07"
"Customer Production Database"
"[email protected]"
94
true
false
["Asset", "Database", "Secret"]
"2026-01-01"
"All Data"

FIND cybercells
WHERE risk_score >= 90
AND trust_score < 20
AND type IN ["Asset", "Database", "Secret"]
AND name CONTAINS "prod"

FIND cybercells
WHERE IS critical
AND HAS attack_path TO crown_jewel
SHOW path, evidence, blast_radius

FIND attack_paths
WHERE severity = "critical"
SHOW start_node, end_node, hops, risk_score, recommended_containment
AS graph

FIND object_type
WHERE conditions
SHOW fields
ORDER BY field ASC|DESC
LIMIT number
AS view

FIND cybercells
SHOW name, type, risk_score, trust_score

FIND cybercells
WHERE risk_score > 85
SHOW name, type, owner, zone, evidence_status
ORDER BY risk_score DESC

FIND cybercells
WHERE type = "Asset"
AND zone = "production"
AND sensitivity = "critical"
SHOW risk_score, trust_score, encryption_status, policy_status

FIND identities
WHERE trust_score < 30
SHOW owner, risk_score, recent_sessions, attack_paths

FIND cybercells
WHERE type = "Database"
AND sensitivity IN ["high", "critical"]
AND encryption_status = "unencrypted"
SHOW owner, business_service, risk_score, evidence_status

FIND cybercells
WHERE type = "Secret"
AND ai_visibility = "allowed"
SHOW owner, policy_status, evidence_status, risk_score

FIND cybercells
WHERE policy_status = "violation"
SHOW name, type, policy_status, risk_score, owner
ORDER BY risk_score DESC

FIND cybercells
WHERE evidence_status IN ["missing", "partial"]
SHOW name, type, risk_score, evidence_status

FIND memories
WHERE freshness_score < 40
SHOW title, source, trust_score, evidence_score, action_eligible

FIND memories
WHERE status = "quarantined"
SHOW title, poisoning_risk, prompt_injection_risk, evidence_score

FIND incidents
WHERE status IN ["open", "investigating", "contained"]
SHOW incident_key, severity, phase, owner, risk_score

FIND attack_paths
WHERE severity = "critical"
SHOW start_node, end_node, hops, risk_score, recommended_containment

FIND kinetic_actions
WHERE proof_status != "verified"
OR rollback_status = "failed"
SHOW action_type, target, risk_before, risk_after, actual_impact

SHOW object_type "object-name"
WITH sections
AS view

SHOW cybercell "prod-api-07"
WITH overview, risk, trust, evidence, policies, relationships

SHOW attack_paths
FOR asset "prod-api-07"
AS graph

SHOW evidence
FOR incident "INC-2026-0042"
AS evidence

SHOW memory_safety
FOR agent "Aina SOC Agent"
WITH trusted, quarantined, action_eligible, blocked

SHOW policies
FOR cybercell "customer-db-primary"
WITH conditions, allowed_actions, forbidden_actions

SHOW encryption
FOR cybercell "customer-db-primary"
WITH key, rotation, decryption_events, violations

SHOW proof_bundle "PB-INC-2026-0042"
WITH evidence, hashes, approvals, timeline, actions

TRACE source_type "source"
TO target_type "target"
VIA relationship_types
WHERE constraints
SHOW result_fields

TRACE identity "[email protected]"
TO database "customer-db-primary"
SHOW path, credentials, sessions, evidence

TRACE asset "prod-api-07"
TO crown_jewel "Customer Production Database"
SHOW path, hops, vulnerabilities, attack_techniques, evidence

TRACE credential "svc-payments-token"
TO business_service "Customer Portal"
SHOW reachable_assets, databases, secrets, risk_score

TRACE asset "workstation-22"
TO zone "production"
VIA sessions, credentials, network_paths
SHOW path, risk_score, cut_points

TRACE identity "[email protected]"
TO role "cloud-admin"
VIA iam_policies, groups, service_accounts
SHOW path, policy_gaps, recommended_fix

TRACE agent "Aina SOC Agent"
TO sensitivity "restricted"
SHOW memories, cybercells, policies, blocked_paths

TRACE all
TO crown_jewel
WHERE risk_score > 70
SHOW start_node, end_node, hops, evidence_count, recommended_cut_point
AS graph

TRACE shortest
FROM identity "[email protected]"
TO database "customer-db-primary"
SHOW path, hops, risk_score

TRACE attack_paths
TO crown_jewel "Customer Production Database"
SHOW cut_points, risk_reduction, business_impact
ORDER BY risk_reduction DESC

REPLAY object_type "object-id"
FROM start_point
TO end_point
SHOW sections
AS timeline

REPLAY incident "INC-2026-0042"
FROM first_seen
TO contained
SHOW timeline, graph, evidence, ai_decisions, actions

REPLAY cybercell "prod-api-07"
FROM created
TO now
SHOW risk_changes, policy_changes, evidence_changes, relationships

REPLAY attack_path "AP-018"
SHOW stages, lateral_movement, privilege_escalation, evidence
AS timeline

REPLAY action "ACT-1044"
SHOW requested_by, approved_by, executed_by, before_state, after_state, proof

REPLAY identity "[email protected]"
FROM "2026-01-01"
TO "2026-05-01"
SHOW logins, sessions, privileges, anomalies, evidence

REPLAY ai_decision "AID-2026-0091"
SHOW prompt_context, evidence_used, policy_constraints, recommendation, human_response

REPLAY incident "INC-RANSOM-2026-01"
SHOW initial_access, execution, credential_access, lateral_movement, containment, recovery

SIMULATE action "action-name"
ON object_type "object-name"
WITH constraints
SHOW outputs
AS simulation

SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact, risk_delta, rollback_plan, approval_required

SIMULATE action "rotate-credential"
ON credential "svc-payments-token"
SHOW affected_services, risk_reduction, downtime_estimate, rollback_plan

SIMULATE action "disable-user"
ON identity "[email protected]"
SHOW active_sessions, business_impact, approval_required, rollback_plan

SIMULATE action "revoke-token"
ON credential "api-token-prod-17"
SHOW services_impacted, attack_paths_removed, trust_delta

SIMULATE action "block-ip"
ON indicator "185.44.12.9"
SHOW affected_connections, false_positive_risk, evidence_support

SIMULATE action "isolate-database"
ON database "customer-db-primary"
SHOW affected_users, affected_services, revenue_impact, approval_required

SIMULATE scenario "cloud-key-leak"
ON credential "aws-prod-admin-key"
SHOW reachable_assets, crown_jewel_exposure, recommended_actions

SIMULATE scenario "ransomware-spread"
FROM asset "workstation-22"
SHOW reachable_hosts, backup_exposure, containment_options

SIMULATE action "run-containment-playbook"
ON agent "Aina SOC Agent"
WITH target = "prod-api-07"
SHOW allowed_actions, blocked_actions, policy_requirements, max_blast_radius

SIMULATE containment_options
ON incident "INC-2026-0042"
SHOW options, risk_reduction, business_impact, reversibility
ORDER BY safety_score DESC

VERIFY object_type "object-id"
SHOW verification_fields
AS evidence

VERIFY evidence "EV-7781"
SHOW hash_chain, source, timestamp, signature, anchor

VERIFY proof_bundle "PB-INC-2026-0042"
SHOW evidence, hashes, approvals, timeline, chain_status

VERIFY action "ACT-1044"
SHOW authorization, evidence_basis, policy_decision, risk_before, risk_after

VERIFY encryption
FOR database "customer-db-primary"
SHOW key, policy, last_rotation, decryption_events

VERIFY ai_access
FOR memory "MEM-9201"
SHOW visibility, policy, action_eligibility, training_permission

VERIFY compliance_control "SOC2-CC6.1"
SHOW evidence, policy, last_verified_at, gaps

VERIFY tenant_isolation
FOR tenant "Rocheston Demo"
SHOW cross_tenant_access, memory_scope, vector_scope, policy_scope

VERIFY evidence_chain "CHAIN-9011"
SHOW records, missing_links, hash_status, signatures

WHY subject
SHOW explanation_fields

WHY asset "prod-api-07" IS high_risk
SHOW factors, evidence, attack_paths, policy_violations

WHY risk_score INCREASED
FOR cybercell "prod-api-07"
SHOW changed_fields, new_relationships, evidence, timeline

WHY trust_score DROPPED
FOR identity "[email protected]"
SHOW sessions, anomalies, policy_events, source_reputation

WHY action "isolate-host" WAS blocked
FOR asset "prod-api-07"
SHOW policy, business_impact, approval_required, rollback_status

WHY memory "MEM-9201" IS quarantined
SHOW prompt_injection_risk, poisoning_risk, source, evidence

WHY agent "Aina SOC Agent" CANNOT use memory "MEM-9201"
SHOW policy, sensitivity, tenant_scope, action_eligibility

WHY evidence "EV-7781" IS weak
SHOW source_reputation, confidence, signature_status, contradictions

WHY attack_path "AP-018" EXPOSES crown_jewel
SHOW path, credentials, vulnerabilities, policies, evidence

ASK aina "question"
USING context
SHOW sources, evidence, recommendations

ASK aina "Which CyberCells are most dangerous right now?"
USING cybercells
SHOW summary, evidence, recommended_actions

ASK aina "What happened in this incident?"
USING incident "INC-2026-0042"
SHOW timeline, root_cause, evidence, next_steps

ASK aina "What is the safest containment option?"
USING incident "INC-2026-0042"
SHOW options, business_impact, risk_reduction, approvals

ASK aina "Can this memory be used for action?"
USING memory "MEM-9201"
SHOW policy, evidence, memory_safety, answer

ASK aina "Can we prove this incident was contained?"
USING proof_bundle "PB-INC-2026-0042"
SHOW missing_evidence, verified_evidence, conclusion

ASK aina "Generate a ZelQL query for unencrypted crown jewels"
SHOW zelql, explanation

ASK aina "Summarize current risk for executives"
USING reports, cybercells, incidents
SHOW executive_summary, top_risks, recommendations

QUARANTINE object_type "object-id"
REASON "reason"
SHOW impact

QUARANTINE memory "MEM-9201"
REASON "prompt injection risk"
SHOW affected_agents, policies, evidence

QUARANTINE evidence "EV-7781"
REASON "signature mismatch"
SHOW chain_impact, related_incidents, required_review

QUARANTINE cybercell "rootkit-alert-2026"
REASON "suspected compromise"
SHOW relationships, attack_paths, blast_radius

QUARANTINE ai_decision "AID-2026-0091"
REASON "unsupported by evidence"
SHOW evidence_gaps, human_review_required

QUARANTINE memories
WHERE poisoning_risk > 80
SHOW affected_agents, blocked_actions, evidence

ANCHOR evidence "EV-7781"
WITH hash_chain
SHOW hash, timestamp, anchor_id

ANCHOR proof_bundle "PB-INC-2026-0042"
WITH external_anchor
SHOW hash, chain_status, export_path

ANCHOR incident "INC-2026-0042"
WITH timeline_hash
SHOW events, hash, proof_status

ANCHOR action "ACT-1044"
WITH action_receipt
SHOW chain_hash, approvals, evidence

COMPARE state BEFORE action "ACT-1044"
WITH state AFTER action "ACT-1044"
SHOW risk_delta, trust_delta, attack_paths_removed, business_impact

COMPARE cybercell "prod-api-07"
WITH cybercell "prod-api-08"
SHOW risk, trust, evidence, policies, attack_paths

COMPARE snapshot "SNAP-2026-01"
WITH snapshot "SNAP-2026-05"
SHOW new_risks, fixed_risks, policy_changes, trust_delta

COMPARE incident "INC-2026-0042"
WITH incident "INC-2026-0099"
SHOW containment_time, evidence_strength, risk_reduction, lessons

COMPARE memory_cluster "ransomware-playbooks"
WITH memory_cluster "approved-playbooks"
SHOW poisoning_risk, evidence_score, action_eligibility

REPORT cybercell_inventory
WHERE risk_score > 70
INCLUDE summary, table, evidence, recommendations
EXPORT html

REPORT executive_security_summary
DURING "All Data"
INCLUDE risk, trust, incidents, attack_paths, evidence, recommendations
EXPORT pdf

REPORT incident_containment_proof
FOR incident "INC-2026-0042"
INCLUDE timeline, evidence, actions, approvals, before_after
EXPORT html

REPORT compliance
FOR framework "SOC 2"
INCLUDE controls, evidence, gaps, proof_bundles
EXPORT csv

REPORT ai_memory_safety
WHERE status IN ["quarantined", "contradicted", "training-blocked"]
INCLUDE memory_scores, evidence, policies, recommendations
EXPORT json

REPORT blast_radius
FOR asset "prod-api-07"
INCLUDE affected_services, risk_delta, rollback_plan, approvals
EXPORT html

EXPORT last_result AS csv

FIND cybercells
WHERE risk_score > 80
SHOW name, type, risk_score, evidence_status
EXPORT csv

EXPORT evidence
FOR incident "INC-2026-0042"
AS proof_bundle

EXPORT report "Executive Security Reality Summary"
AS html

FIND attack_paths
WHERE severity = "critical"
EXPORT raw_json

CREATE cybercell "prod-api-07"
TYPE "Asset"
ZONE "production"
OWNER "devops"
BUSINESS_SERVICE "Customer Portal"
SENSITIVITY "critical"
RISK_SCORE 94
TRUST_SCORE 12
CONFIDENCE_SCORE 94

CREATE policy "AI cannot use quarantined memory"
TYPE "AI Visibility"
SCOPE "ZelMemory"
CONDITION status = "quarantined"
FORBID action_use, training_use, recommendation_use

CREATE memory "Ransomware containment lesson"
TYPE "Security Lesson"
SOURCE "Incident INC-2026-0042"
STATUS "verified"
ACTION_ELIGIBLE true
EVIDENCE_SCORE 92

CREATE evidence "Host isolation approval"
TYPE "Human Approval"
SOURCE "SOC Manager"
FOR action "ACT-1044"
CONFIDENCE 95

UPDATE cybercell "prod-api-07"
SET risk_score = 84
REASON "credential rotated and attack path removed"

UPDATE cybercell "customer-db-primary"
SET ai_visibility = "restricted"
REASON "critical database with regulated data"

LINK identity "[email protected]"
TO asset "prod-api-07"
AS privileged_access
WITH risk_weight = 85

LINK asset "prod-api-07"
TO database "customer-db-primary"
AS connects_to
WITH trust_level = "low"

UNLINK identity "[email protected]"
FROM asset "prod-api-07"
AS privileged_access
REASON "access revoked"

SCORE risk
FOR cybercell "prod-api-07"
SHOW factors, previous_score, new_score

SCORE memory_safety
FOR memory "MEM-9201"
SHOW poisoning_risk, prompt_injection_risk, evidence_score

SCORE action_safety
FOR action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, reversibility, approval_required

SNAPSHOT security_state
NAME "Pre-Containment Snapshot"
INCLUDE cybercells, relationships, evidence, policies, memory, actions

SNAPSHOT cybercell "prod-api-07"
NAME "Before Host Isolation"
INCLUDE risk, trust, evidence, relationships, policies

WATCH query "Critical CyberCells"
AS
FIND cybercells
WHERE risk_score >= 90
NOTIFY security_team

WATCH query "AI Visible Secrets"
AS
FIND cybercells
WHERE type = "Secret"
AND ai_visibility = "allowed"
NOTIFY admin

EXPLAIN
FIND cybercells
WHERE risk_score > 80
SHOW evidence, attack_paths

EXPLAIN
SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact

statement
  = find_statement
  | show_statement
  | trace_statement
  | replay_statement
  | simulate_statement
  | verify_statement
  | why_statement
  | ask_statement
  | quarantine_statement
  | anchor_statement
  | compare_statement
  | report_statement
  | export_statement
  | create_statement
  | update_statement
  | link_statement
  | unlink_statement
  | score_statement
  | snapshot_statement
  | watch_statement
  | explain_statement

find_statement
  = FIND object_type [WHERE condition] [SHOW fields] [ORDER BY field direction] [LIMIT number] [AS view]

trace_statement
  = TRACE source TO target [VIA relationships] [WHERE condition] [SHOW fields] [AS view]

replay_statement
  = REPLAY object_ref [FROM time_ref] [TO time_ref] [SHOW fields] [AS timeline]

simulate_statement
  = SIMULATE action_or_scenario ON object_ref [WITH options] [SHOW fields] [AS simulation]

verify_statement
  = VERIFY object_ref [SHOW fields] [AS evidence]

why_statement
  = WHY subject [SHOW fields]

ask_statement
  = ASK aina string [USING context] [SHOW fields]

quarantine_statement
  = QUARANTINE object_ref [REASON string] [SHOW fields]

anchor_statement
  = ANCHOR object_ref [WITH method] [SHOW fields]

compare_statement
  = COMPARE object_ref WITH object_ref [SHOW fields]

report_statement
  = REPORT report_type [FOR object_ref] [WHERE condition] [INCLUDE sections] [EXPORT format]

export_statement
  = EXPORT target AS format

id
tenant_id
name
slug
type
owner
zone
business_service
sensitivity
risk_score
trust_score
confidence_score
encryption_status
ai_visibility
policy_status
evidence_status
description
metadata
relationships
timeline
mutation_history
action_eligibility
created_by
created_at
updated_at
is_demo

id
tenant_id
title
evidence_type
source
actor
target
event_type
before_state
after_state
hash_value
signature_value
chain_id
confidence
forensic_relevance
policy_id
incident_id
cybercell_id
status
source_reputation
created_at
is_demo

id
tenant_id
title
content
source
memory_type
sensitivity
trust_score
evidence_score
freshness_score
poisoning_risk
prompt_injection_risk
ai_visibility
action_eligible
training_allowed
status
created_at
updated_at
is_demo

id
tenant_id
action_type
target
requested_by
approved_by
executed_by
ai_confidence
policy_id
zelc_rule
evidence_id
predicted_blast_radius
actual_impact
risk_before
risk_after
rollback_status
proof_status
chain_hash
created_at
is_demo

id
tenant_id
name
policy_type
scope
condition
allowed_actions
forbidden_actions
approval_required
ai_visibility_rule
training_rule
export_rule
encryption_rule
status
created_at
updated_at
is_demo

id
name
type
owner
tenant
zone
business_service
sensitivity
risk_score
trust_score
confidence_score
evidence_score
freshness_score
poisoning_risk
prompt_injection_risk
policy_status
evidence_status
encryption_status
ai_visibility
action_eligible
training_allowed
created_at
updated_at
relationships
attack_paths
blast_radius
business_impact
rollback_plan
approval_required
proof_status
chain_hash

FIND cybercells
WHERE risk_score > 80
SHOW name, type, risk_score, trust_score

FIND incidents
WHERE status != "closed"
SHOW incident_key, severity, phase

FIND attack_paths
WHERE severity IN ["critical", "high"]
SHOW start_node, end_node, risk_score

FIND evidence
WHERE status != "verified"
SHOW title, source, confidence

FIND memories
WHERE status = "quarantined"
SHOW title, poisoning_risk, prompt_injection_risk

FIND cybercells
WHERE type = "Asset"
SHOW name, owner, zone, risk_score

SHOW cybercell "prod-api-07"
WITH overview, relationships, evidence, policies

WHY cybercell "prod-api-07" IS high_risk
SHOW factors, evidence, recommendations

TRACE asset "prod-api-07"
TO database "customer-db-primary"
SHOW path, relationships, evidence
AS graph

TRACE all
TO crown_jewel
WHERE risk_score > 70
SHOW path, risk_score, cut_points
AS graph

FIND attack_paths
WHERE risk_score > 80
SHOW start_node, end_node, hops, recommended_containment

TRACE identity "[email protected]"
TO crown_jewel "Customer Production Database"
SHOW path, credentials, sessions

REPLAY incident "INC-2026-0042"
SHOW timeline, evidence, ai_decisions, actions

VERIFY incident "INC-2026-0042"
SHOW containment_status, proof_bundle, residual_risk

VERIFY evidence "EV-7781"
SHOW hash_chain, signature, source, timestamp

FIND evidence
WHERE confidence < 60
SHOW title, source, related_incident

FIND memories
WHERE status = "quarantined"
SHOW title, reason, poisoning_risk

WHY memory "MEM-9201" IS quarantined
SHOW prompt_injection_risk, evidence, policy

FIND ai_agents
WHERE risk_score > 70
SHOW name, tools, allowed_actions, policy_status

VERIFY action_eligibility
FOR agent "Aina SOC Agent"
ON action "isolate-host"
SHOW allowed, blocked_by, approval_required

FIND kinetic_actions
SHOW action_type, target, risk_before, risk_after, proof_status

VERIFY action "ACT-1044"
SHOW evidence, approvals, chain_hash

SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact, rollback_plan

SIMULATE containment_options
ON incident "INC-2026-0042"
SHOW options, risk_reduction, business_impact

FIND policies
WHERE violation_count > 0
SHOW name, policy_type, affected_objects

WHY policy "AI Restricted Data Policy"
BLOCKED memory "MEM-9201"
SHOW sensitivity, tenant_scope, action_eligibility

FIND cybercells
WHERE encryption_status = "unencrypted"
AND sensitivity = "critical"
SHOW name, type, owner, risk_score

VERIFY encryption
FOR cybercell "customer-db-primary"
SHOW key, rotation, policy, evidence

VERIFY compliance_control "SOC2-CC6.1"
SHOW evidence, gaps, last_verified_at

REPORT compliance
FOR framework "SOC 2"
INCLUDE controls, evidence, gaps
EXPORT html

REPORT executive_security_summary
DURING "All Data"
INCLUDE risk, trust, incidents, evidence, ai_safety, recommendations
EXPORT html

REPORT critical_cybercells
WHERE risk_score >= 90
INCLUDE summary, table, evidence, attack_paths
EXPORT csv

REPORT ai_memory_safety
INCLUDE quarantined, poisoned, training_blocked, action_eligible
EXPORT html

FIND cybercells
WHERE risk_score > 70
SHOW name, type, risk_score, trust_score, policy_status
AS cards

FIND cybercells
WHERE zone = "production"
SHOW name, type, owner, risk_score, trust_score, encryption_status
AS table

TRACE asset "prod-api-07"
TO crown_jewel "Customer Production Database"
SHOW path, relationships, risk_score
AS graph

REPLAY incident "INC-2026-0042"
SHOW timeline, risk_changes, actions
AS timeline

SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact, rollback_plan
AS simulation

VERIFY evidence "EV-7781"
SHOW hash_chain, source, timestamp, signature
AS evidence

ASK aina "Explain this result"
USING last_result
SHOW summary, recommendations, evidence

FIND cybercells
WHERE risk_score > 90
EXPORT raw_json

SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact, rollback_plan, approval_required

Building Security Reality Graph...
Loaded 59 relationships.
Tracing attack paths...
Detected lateral movement path.
Detected privilege escalation path.
Computing blast radius...
Tenant isolation: ENFORCED.
Policy-bound retrieval: ENFORCED.
Result set verified and signed.

Cells scanned: 68
Attack vectors evaluated: 9
Max risk score: 80
Execution time: 47ms
Simulation status: COMPLETE

FIND cybercells
WHERE type = "Asset"
AND risk_score > 80
SHOW name, owner, zone, risk_score, evidence_status

FIND cybercells
WHERE type = "Database"
AND sensitivity = "critical"
AND encryption_status = "unencrypted"
SHOW name, owner, policy_status, risk_score

TRACE identity "[email protected]"
TO database "customer-db-primary"
SHOW path, credentials, sessions, evidence

REPLAY incident "INC-2026-0042"
FROM first_seen
TO contained
SHOW timeline, evidence, ai_decisions, actions

VERIFY evidence "EV-7781"
SHOW hash_chain, signature, timestamp, source

SIMULATE action "isolate-host"
ON asset "prod-api-07"
SHOW blast_radius, business_impact, rollback_plan

WHY action "isolate-host" WAS blocked
FOR asset "prod-api-07"
SHOW policy, business_impact, approval_required

QUARANTINE memory "MEM-9201"
REASON "prompt injection risk"
SHOW affected_agents, blocked_actions, evidence

ASK aina "Summarize this report for executives"
USING report "Executive Security Reality Summary"
SHOW summary, key_risks, recommendations

ASK aina "Which action is safest?"
USING (
  FIND cybercells
  WHERE risk_score > 85
  AND business_service = "Customer Portal"
)
SHOW recommendation, evidence, policy_constraints

SIMULATE action "rotate-credential"
ON (
  FIND credentials
  WHERE risk_score > 80
)
SHOW affected_services, risk_delta, rollback_plan

TRACE identity "[email protected]"
TO crown_jewel "Customer Production Database"
SHOW path, evidence

VERIFY last_result
SHOW evidence_strength, policy_status, proof_status

FIND cybercells
WHERE risk_score > 90
SHOW name, type, evidence, policy

REPORT last_result
AS "Critical CyberCells Report"
EXPORT html

REPLAY incident "INC-2026-0042"
SHOW timeline, actions, risk_changes

WHY risk_score INCREASED
DURING last_replay
SHOW factors, evidence, source_events

FIND human_ai_decisions
WHERE status = "approved"
SHOW recommendation, human_response, outcome, risk_after

FIND human_ai_decisions
WHERE status = "rejected"
SHOW recommendation, reason, alternative_action, outcome

FIND human_ai_decisions
WHERE risk_after < risk_before
SHOW recommendation, risk_before, risk_after, evidence_id

FIND human_ai_decisions
WHERE human_response = "override"
SHOW recommendation, reason, business_impact, outcome

WHY ai_decision "AID-2026-0091" recommended action "rotate-credential"
SHOW evidence, policy, context, confidence

VERIFY compliance_control "MFA-Enforcement"
SHOW users, policies, evidence, exceptions

VERIFY compliance_control "Privileged Access Review"
SHOW identities, approvals, evidence, last_reviewed_at

VERIFY compliance_control "Encryption at Rest"
SHOW encrypted_cybercells, keys, policy, evidence

VERIFY ai_access_restrictions
WHERE classification = "restricted"
SHOW denied_attempts, policies, audit_logs

VERIFY incident_response
FOR incident "INC-2026-0042"
SHOW timeline, evidence, approvals, containment, recovery

CREATE proof_bundle "SOC 2 Evidence Pack"
FOR framework "SOC 2"
INCLUDE controls, evidence, policies, incidents, actions

ERROR: ACTION_BLOCKED_BY_POLICY
Policy: Production Host Isolation Requires Approval
Reason: Target asset is production and business impact is high.
Next step: Run SIMULATE with approval_required or request human approval.

ERROR: TENANT_SCOPE_DENIED
Reason: Query attempted to access CyberCells outside the active tenant.
Tenant isolation: enforced.

ERROR: MEMORY_QUARANTINED
Memory: MEM-9201
Reason: Prompt injection risk is high.
Allowed use: human review only.
Blocked use: AI recommendation, AI action, training.

ERROR: EVIDENCE_WEAK
Evidence confidence: 42
Reason: unsigned source and missing chain link.
Recommended action: verify source or attach stronger evidence.

{
  "query_id": "ZQL-2026-0091",
  "tenant_isolation": "enforced",
  "policy_bound_retrieval": "enforced",
  "memory_quarantine_filter": "enabled",
  "evidence_weighting": "enabled",
  "result_verified": true,
  "execution_time_ms": 47,
  "cells_scanned": 68,
  "relationships_loaded": 59,
  "attack_vectors_evaluated": 9
}

FIND risk.
TRACE exposure.
REPLAY incidents.
SIMULATE action.
VERIFY proof.
WHY decisions.
QUARANTINE poisoned memory.