Graph Model

Neo4j data model and relationships

Overview

Polaris uses Neo4j, a graph database, to model the relationships between technologies, systems, teams, and version constraints. This enables powerful queries about technology usage and compliance.

This page covers the core governance model. A few supporting node types (import jobs, health-refresh jobs, health snapshots, advisories, hashes, external references, API tokens) are omitted here for diagram clarity — see .claude/mcp/graph-schema.md for the complete schema.

Graph Visualization

Core Nodes

Technology

Approved technologies, requires at least one linked Component as evidence of real usage

Platform

Manually-declared infrastructure/services SBOM scanning can never observe (databases, cloud services) — superuser-only

System

Deployable applications and services

Component

SBOM entries (libraries, packages)

Team

Organizational teams

VersionConstraint

Version range constraints for technologies

License

Software licenses

Repository

Source code repositories

AuditLog

Change tracking entries

Key Relationships

Team stewards TechnologySTEWARDED_BY

Technical governance responsibility

Team stewards PlatformSTEWARDED_BY

Same stewardship model as Technology, for manually-declared infrastructure

Team owns SystemOWNS

Operational ownership

Team uses TechnologyUSES

Actual technology usage by a team

Team approves TechnologyAPPROVES

TIME framework approval

Team approves PlatformAPPROVES

TIME framework approval, same shape as Technology

Team maintains RepositoryMAINTAINS

Repository maintenance responsibility

Component is version of TechnologyIS_VERSION_OF

Component to technology mapping

Component has LicenseHAS_LICENSE

License(s) declared for a component

System uses ComponentUSES

System dependency on a component. Carries scope (runtime, required, dev, optional, excluded, or null) and isDirect (true for root-level deps, false for transitive). Scope and isDirect are computed by BFS propagation at ingest time.

System has source in RepositoryHAS_SOURCE_IN

Source code location

VersionConstraint governs TechnologyGOVERNS

Constraint scope

Team is subject to VersionConstraintSUBJECT_TO

Organization-scoped constraints link to every Team at creation time, in one pass — a Team created afterward is not automatically included. Team-scoped constraints link only to the one named Team.

AuditLog performed by UserPERFORMED_BY

Who made the change

AuditLog audits EntityAUDITS

What was changed

Query Examples

Find all systems using a deprecated technology

List teams affected by a license rule change

Trace component dependencies across systems

Identify compliance violations

Track all changes made by a specific user

Find all direct runtime dependencies of a system

Find all systems that use a component at runtime vs. dev-only

Find all Platforms with no recorded team approval