Severance: An IAM Security Agent That Explains and Tests Its Fixes

Description and use

Severance is an AI agent that analyzes an IAM graph, identifies exposure paths, proposes a specific relationship removal, simulates the impact, and requires approval, achieving 100 % accuracy on benchmark cases.

Problem

Security findings expose relationships but rarely suggest which relationship to change without disrupting legitimate access.

Outcome

Severance passed 30 of 30 deterministic engine evaluations and 6 of 6 live investigations, reducing untrusted reachers to zero with no collateral impact in approved cases.

Workflow

• 1. Import IAM data into FalkorDB graph.
• 2. Run reachability Cypher queries to find principals connected to the target resource.
• 3. Use algorithmic shortest path and betweenness centrality to rank candidate relationship removals.
• 4. Simulate each candidate on a disposable graph copy using GRAPH.COPY and measure impact.
• 5. Present the selected fix with supporting path, metrics, and collateral impact to the operator.
• 6. Operator approves or rejects; approval generates a single‑use token for the specific plan.
• 7. If approved, Severance applies the edge deletion; otherwise the graph remains unchanged.

Evidence

Severance is an AI agent that investigates an IAM graph, explains the path behind an exposure, proposes a specific relationship to remove, and tests that change before asking for approval.

Source

The planner then evaluates candidate relationship removals using GRAPH.COPY. Each candidate is tested on a disposable copy, allowing the same reachability queries to measure its effect.

Source

The final run passed 30 out of 30 deterministic engine evaluations and six out of six live Sonnet MCP-agent investigations.

Source

An IAM snapshot is not the complete AWS authorization environment.

Source