With safe LLM architecture built in GraphAware Hume, intelligence analysts can combine the power of graphs and AI into a single secure, flexible environment
As part of our mission to empower intelligence analysts with cutting-edge technology, GraphAware has been exploring how large language models (LLMs) can be reliably combined with knowledge graphs to enhance analytical workflows. In our latest effort, we’ve taken a pragmatic approach with Maestro, an AI-powered assistant built into GraphAware Hume that introduces generative AI capabilities without compromising data security or trust.
One of the most exciting developments is our use of a GraphRAG (Retrieval-Augmented Generation) architecture directly from within Hume. This post explores the challenges of implementing such an architecture in the context of intelligence analysis, where law enforcement and security agencies demand high levels of control, transparency, and security.
GraphRAG as a Workflow
To make this architecture viable and operationally effective in secure environments, we rely on Hume Orchestra to orchestrate the entire flow. Here’s how Orchestra enables GraphRAG within Hume:
- Event-driven ingestion
Orchestra listens for document upload events and automatically triggers parsing and processing workflows — whether from PDFs, CSVs, or other formats. - Graph modeling of documents
It transforms raw documents into structured graph representations, organizing content into semantically coherent sections and linking them hierarchically as nodes and relationships. - Embedding generation and storage
Each content chunk is embedded using LLMs, and the resulting vectors are stored alongside graph data in Neo4j — enabling semantic similarity search and AI-powered retrieval. - Hybrid retrieval pipeline orchestration
Orchestra coordinates both vector-based semantic search and full-text keyword search, maximizing relevance and precision during the retrieval phase. - Security and access control
It ensures that embeddings and retrieved content inherit the same role- and case-based access controls as the original graph data — maintaining compliance with strict intelligence and data protection standards. - Context-aware augmentation
The system dynamically adjusts retrieval inputs based on user roles, ongoing investigations, or the location of the query in the application — delivering grounded, context-relevant responses while preventing hallucinations.
Architecting Systems for natural language queries on intelligence data
Here we share key insights essential for deploying generative AI in intelligence environments without compromising trust, privacy, or precision.
1. Flexible Architecture: Context Is Everything
A simple system diagram can mask a range of architectural choices—especially when working with intelligence documents. The foundational question is: How are these documents modeled in your system?
Should they form a continuous graph or should they live as objects tied to specific cases, investigations, or users? Consider a scenario where an analyst is testing a hypothesis in isolation—the system must allow that analyst to work in a private workspace before information is shared more broadly.
This makes data modeling crucial. Intelligence data must remain tightly bound to its context—documents should not be detached entities but part of a connected data ecosystem. The graph must reflect relationships not just between entities, but between the data and its operational meaning: Who is looking at this? Why? In which investigative frame?
A flexible architecture accommodates:
- Flexible, granular scoping of information, such as per-user or per-case
- Evolving document graphs
- Experimentation and staging workflows
2. Secure Architecture: Embeddings and LLM Interactions Are Sensitive, Too
Security in intelligence environments cannot be an afterthought. It must be designed into every layer of the architecture from the beginning. In natural language systems, this extends beyond traditional data protection. Embeddings, which are vector representations of text, may appear abstract, but they encapsulate sensitive meaning and must be treated with the same level of protection as the original intelligence data.
Storing embeddings in external vector databases introduces security risks, especially if access controls are not synchronized with your main system. Instead, the most secure and maintainable approach is to store embeddings directly within the graph platform, such as Neo4j, reusing its native security model. Hume, for example, leverages Neo4j’s robust access control mechanisms (RBAC and PBAC) to ensure that permissions applied to documents also apply to embeddings and any AI driven outputs.
When integrating large language models, the architecture must also account for auditability and data protection. Every interaction with a language model should be monitored and logged. If cloud based models are used, additional safeguards are necessary, such as redacting or pseudonymizing personally identifiable information before sending it for processing. For on premise models, the need for deidentification may be reduced, but features like audit logging, single sign on, and jailbreak detection still need to be in place to ensure responsible use and compliance.
The bottom line: embeddings, language model prompts, and retrieval context should all inherit the same security controls as your graph data. This unified security approach ensures compliance, reduces architectural complexity, and protects the integrity of your intelligence workflows.
3. Context-Aware Architecture: Better Input Yields Better Output
Large Language Models (LLMs) are only as useful as the context you give them. That’s why context-aware architecture is a must-have when building natural language interfaces for intelligence analysis.
Unlike typical business queries, intelligence questions often rely on historical nuance, connections between people, organizations, and prior investigations and what you can see on the screen. To support this, the system must:
- Understand which case or investigation the analyst is working on
- Fetch related entities, past queries, and linked documents as context
- Tailor the LLM’s prompt dynamically based on all available knowledge
A truly context-aware architecture allows analysts to query not just a snapshot of data, but an evolving web of intelligence information. This improves not only the precision of answers, but also the relevance, cutting down on noise and accelerating insight.
In practice, this means:
- Designing the system to dynamically assemble prompts with relevant graph context
- Using retrieval-augmented generation (RAG) with real-time graph traversal
- Allowing analysts to pivot easily between cases while maintaining scope awareness
To see these concepts in action and hear directly from the architects behind the system, we invite you to watch the full webinar, AI Powered Intelligence Analysis.
Webinar: AI Powered Intelligence Analysis
Unlike traditional tools, Hume is graph-aware at every level, giving intelligence analysts a unique advantage when combined with generative AI.
Watch Now