The Verified Org Graph: Why AI Needs to Know Who Reports to Whom

Ask a generic AI assistant "who should approve this?" and it will happily invent a plausible-sounding answer. It has no idea who your CFO is, who reports to whom, or which department owns the decision. For consumer use that's harmless. Inside a company, a context-free answer is a wrong answer waiting to happen.

The fix is structural: give the AI a verified org graph to stand on.

A graph of typed relationships, not a static chart

Crestline models the organisation as connected entities — Organization → Department → Membership → User — where every relationship is a typed foreign key. The reporting line lives on Membership.managerId, and writes are cycle-safe, so the graph can't be corrupted into someone managing their own manager.

This isn't a slide that goes stale the day someone changes teams. It's the live structure the whole product reads from.

Access control falls out of the structure

Here's the elegant consequence: permissions don't need a separate system. Because the graph encodes who manages whom, row-level access derives from it directly — a manager sees their subtree, an individual contributor sees themselves and their department peers. There's no parallel permissions matrix to maintain and drift out of sync. Change the reporting line, and access updates with it.

Tokens that resolve to real people at run time

The org graph also gives automations and messages a vocabulary. Instead of hard-coding names or emails, Crestline uses tokens that resolve against the live structure:

@self                — the caller
@manager_of(@self)   — their direct manager
@reports_of(userId)  — someone's direct reports
@dept-finance        — everyone in the finance department
@cxo                 — the top-level executive

A workflow that escalates a blocker to @manager_of(@self) keeps working after a reorg, because it resolves the relationship every time it runs — not a frozen ID captured when the workflow was written.

Every answer is grounded in the graph

When you ask the AI Hub a question, Crestline builds a context block from the verified graph — your identity, role, department, reporting line and recent activity — and hands it to the model. The result is a hierarchy-aware answer: it knows that "my team" means your reports, that a finance question should surface finance's policies, and that some information is above your access level.

The same context powers the Console's deterministic commands — /team, /reports, /org, /whoami — which answer org questions instantly from the database, with no model guesswork at all.

The backbone of a system of record

Memory tells the AI what the company knows. The verified org graph tells it how the company is shaped. Together they're why Crestline can act like a long-tenured colleague instead of a clever stranger — and why its answers come with the structure, the source, and the people attached.

Read how memory complements the graph in Organisational Memory, or explore the solutions.