Access Graph
The Access Graph is a BloodHound-style interactive visualisation of your privileged-access surface. It maps the relationships between identities, accounts, entitlements, target systems, services, and PAM accounts as a live graph, letting you trace inheritance chains, spot risky paths, and understand the blast radius of any single account.
Requires Pro or Enterprise edition.
Getting There
Navigate to Reports > Access Graph.
Starting a Graph
The canvas is empty when you first open the page. Use the search bar in the top-right to find any identity, account, entitlement, system, service, or PAM account by name. Selecting a search result loads that node and its immediate neighbours onto the canvas.
Alternatively, use one of the pre-built queries in the Filters panel to populate the canvas with a curated dataset without needing a starting node.
Navigating the Graph
| Action | Effect |
|---|---|
| Click a node | Selects it — properties and edges appear in the Node Details panel |
| Double-click a node | Merges that node's neighbourhood into the current graph (non-destructive expand) |
| Click canvas background | Deselects the current node |
| Scroll wheel | Zooms in / out |
| Click and drag (background) | Pans the canvas |
| Click and drag (node) | Moves the node; pin it to keep it in place across re-layouts |
Graph Canvas Controls
The toolbar above the graph canvas provides:
| Control | Description |
|---|---|
| + (Zoom in) | Zooms in, centred on the canvas midpoint |
| − (Zoom out) | Zooms out, centred on the canvas midpoint |
| Fit (expand icon) | Fits all visible nodes into the canvas |
| Maximise / Restore | Expands the canvas to fill the full content area (between the topbar and footer, to the right of the sidebar); press again to restore |
A loading spinner appears next to the maximise button while a graph query is in progress.
The maximise mode hides the Node Details, Filters, and Legend panels. Use the search bar (still visible at the top of the page) to start new queries while maximised.
Node Types
Each node type has a unique icon and colour:
| Node Type | Colour | Icon | Description |
|---|---|---|---|
| Identity | Blue | Person (user) | A human or non-human identity record in OrbisID |
| Account | Green | Circle-user | An account on a target system, linked or unlinked to an identity |
| Entitlement | Purple | Padlock | A privilege or role granted to an account |
| Target System | Grey | Server | A scanned target system in the inventory |
| Service | Amber | Gear | A discovered service running on a target system |
| PAM Account | Yellow | Key | An account record in your PAM tool inventory |
Nodes with the PRIVILEGED flag show a red border ring. Inactive nodes (status ≠ ACTIVE) are displayed at reduced opacity.
The selected node is highlighted with an orange border ring.
Edge Types
| Edge Type | Line Style | Meaning |
|---|---|---|
| OWNS | Solid | An identity owns an account |
| HAS_ENTITLEMENT | Solid | An account holds an entitlement |
| NESTED_IN | Dashed | An entitlement is nested inside another (group membership) |
| HOSTS | Solid | A target system hosts an account or service |
| RUNS_AS | Solid | A service runs as an account |
| EXTERNAL_MEMBER | Dotted | Cross-system or external group membership |
| VAULTED_IN | Solid | An account is managed by a PAM account in the vault |
Edges that form part of a path finder result are highlighted in orange.
Right-Hand Panels
Three collapsible panels on the right side of the canvas provide controls and information. Only one panel can be open at a time — opening a panel automatically closes the others.
Node Details
Shown by default when the page loads.
When a node is selected, the Node Details panel shows:
- Type badge and PRIVILEGED badge (if applicable)
- Node label
- Action buttons for the selected node
- Properties table — all key-value properties stored on the node
- Outgoing edges — clickable list of edges from this node to its neighbours
- Incoming edges — clickable list of edges arriving at this node
Clicking a neighbour label in the edge lists jumps the selection to that node.
Node Action Buttons
| Button | Description |
|---|---|
| Expand out | Merges the outbound neighbourhood of this node into the graph |
| Expand in | Merges the inbound neighbourhood of this node into the graph |
| Pin / Unpin | Locks the node's position so it is not moved by subsequent layout runs |
| Hide / Unhide | Temporarily hides the node from the canvas (it remains in the graph state) |
| Set as path start | Marks this node as the start of a path finder query |
| Set as path end | Marks this node as the end of a path finder query |
Focus Toggle (Identity / Account nodes only)
When an Identity or Account node is selected, a Focus toggle switch appears in the Node Details panel:
Focus: hide other identities & accounts
Enabling Focus hides all other Identity and Account nodes from the canvas, along with any entitlements, services, or other nodes that are only reachable via those hidden nodes. Nodes that are also reachable via the focused identity remain visible.
When you expand the graph further (via double-click or Expand buttons) while Focus is active, the filter is automatically re-applied to any newly loaded nodes.
Toggle Focus off (or use Show all hidden nodes) to restore all hidden nodes.
The Focus toggle can be activated even when only one identity is currently on the canvas — it is designed to persist across depth expansions where more identities may appear.
Filters
Changing any filter value automatically re-runs the last graph expansion with the new settings applied — no need to click a separate "Apply" button.
| Filter | Description |
|---|---|
| Depth | How many hops from the root node to traverse (1–6). Lower depth = faster and more focused; higher depth = broader graph |
| Layout | The graph layout algorithm to use when positioning nodes |
| Node types | Restrict which node types are included in the result. Leave empty to include all types |
| Edge types | Restrict which edge types are traversed. Leave empty to include all types |
| Active only / Including inactive | Toggle to include or exclude accounts and identities with a non-ACTIVE lifecycle status |
Layout Options
| Layout | Description |
|---|---|
| Force-directed (default) | Physics-based layout that spreads nodes naturally. Best for general exploration |
| Hierarchical | Top-down tree layout. Best for showing inheritance or delegation chains |
| Concentric | Rings centred on the most-connected node. Best for blast-radius analysis |
Pre-Built Queries
Pre-built queries populate the canvas with a curated dataset without needing a starting node. Select a query from the dropdown to run it immediately.
| Query | Description |
|---|---|
| Privileged services | All services that run as a privileged account, with their associated accounts and systems |
| Unvaulted privileged accounts | Privileged accounts that have no VAULTED_IN edge — not managed by any PAM tool |
| Shared privileged accounts | Privileged accounts identified as shared (multiple identities linked or no owner linked) |
Pre-built queries may be truncated if the result set exceeds the server-side node/edge cap. A warning banner appears when truncation occurs. Narrow your Filters or use a specific search to explore a focused subset.
Path Finder
The Path Finder finds the shortest access path between two nodes, up to 8 hops, and highlights it in orange on the canvas.
- Select a node and click Set as path start
- Select another node and click Set as path end
- In the Filters panel, click Find path
The From and To node labels are shown in the Filters panel for reference. Click the × button to clear both endpoints.
If no path exists within 8 hops in the outbound direction, a notification is displayed and the canvas is unchanged.
Export
| Button | Output |
|---|---|
| PNG | Full-canvas PNG image at 2× resolution with a white background |
| JSON | All nodes and edges currently in the graph state, as a JSON file |
Exported files are named with a timestamp (e.g., access-graph-2026-06-20T10-30-00-000Z.png).
Reset
Reset clears the entire graph state, deactivates Focus mode, and returns the canvas to its empty starting state.
Legend
The Legend panel shows the icon and colour for each node type, and the line style for each edge type.
Tips
- Start broad, then narrow — search for a high-value target system or a privileged entitlement to see what is connected, then use the Focus toggle or node type filter to reduce noise.
- Blast radius — double-click any Account node to expand outward; switch to the Hierarchical layout to see the chain of entitlements inherited by that account.
- Unvaulted accounts — run the Unvaulted privileged accounts pre-built query to instantly see which privileged accounts are not covered by your PAM tool.
- Path analysis — use Path Finder to verify whether a low-privilege account can reach a high-value system through a chain of group memberships or entitlement nesting.
- Pinning — pin key reference nodes before running a second expansion so they stay anchored in position while the layout re-runs around them.