Every enterprise standing up agents reaches the same realisation: a language model is only as reliable as the structured context it can reach, and that context lives in graphs. The market has spent the past year naming those graphs. It has spent almost no time on the question that actually controls cost and competitive position: which of them you should build yourself, which you should adopt from shared infrastructure, and which are not yet mature enough to build anything on at all.
The strategic question is no longer "do we have a knowledge graph." It is "which of the six graphs an agent-first enterprise needs do we build, which do we adopt, and which do we wait for."
§ 02
The two questions that decide the stack
Two questions sit behind every graph an agent touches.
The first is reliability: what the agent needs in order to act correctly and accountably. It has three parts. Comprehension, does the agent understand the situation before it acts. Accountability, was it allowed to act, did it stay in bounds, and can you answer for what it did. Observability, can you see it operating and contain a fault once one appears.
The second question is the one the market skips, and it is where the budget and the moat are won: ownership, who should build each graph. The graphs an agent-first enterprise needs do not all belong to the enterprise. They fall into three tiers.
Get the tier wrong and you spend a year building something you could have adopted, or you try to borrow the one asset that was meant to be your advantage. The rest of this piece sorts the six graphs across those tiers, then turns each into a build, adopt, or wait decision.
§ 03
The six graphs in one view
| Graph | What it carries | Ownership tier | Maturity today |
|---|---|---|---|
| Regulatory graph | The law itself, as structure an agent checks an action against | Shareable utility | Immature; no shared version exists |
| Semantic graph | What entities mean and how they relate | Shareable base, proprietary extension | Mature |
| Governed entity graph | Who and what is who, resolved across systems, and what is permitted on each right now | Proprietary | Partially mature |
| Context graph | Why past decisions were made: the precedent | Proprietary | Early |
| Authority graph | What each actor may do, granted by whom, revocable | Shared standard, proprietary content | Single-step mature, chained not |
| Activity graph | What every actor actually did, and what is moving now | Shared standard, proprietary content | Mature |
Two things feel like graphs but are queries over these, not separate stores. What you have promised outward is a view over the governed entity graph. What an action will touch before it fires is a traversal over the semantic graph. Build them as views, not as substrates.
§ 04
The regulatory graph: the shareable layer the market has not built
Of the six, one is both the most shareable and the least built, and it is the one that decides whether agents can be trusted in regulated work at all.
For an agent to enforce a regulation rather than have its compliance reviewed afterwards, the regulation has to be machine-readable at the moment of action. The agent must be able to ask, before it acts, what the law permits, requires, and prohibits here. None of the other five graphs carry that. The entity graph knows your data flows. The authority graph knows what your agents may do. Neither knows what the EU AI Act actually says.
The decisive property is that the text of a regulation is identical for every organisation under it. The same article binds a bank in Frankfurt and a retailer in Rotterdam. There is no reason for ten thousand enterprises to each parse it into a private graph. The rules are a commons. Only their mapping to your specific reality is yours, and that mapping is a join between the shared regulatory structure and your private entity and authority graphs.
The law is shared. The applicability is proprietary. Adopt the rules; build only how they land on you.
That single distinction resolves the build-versus-buy question for compliance, and it points at the clearest open category in the entire stack. The formal foundations exist and the public-sector "rules as code" movement has proven the approach, but no shared, enterprise-facing regulatory authority covers the regulations enterprises actually operate under in a form agents can enforce against. The category has no mature occupant. For an enterprise leader the implication is concrete: an agent told today to enforce compliance has nothing authoritative to check against, and is in practice enforcing one team's reading of a PDF.
§ 05
What to build, what to adopt, what to wait on
| Tier | Graphs | The move | Why |
|---|---|---|---|
| Shareable utility | Regulatory; semantic base | Adopt where it exists; wait or build narrowly where it does not | Duplicating shared infrastructure is waste, and the regulatory utility is not yet available |
| Shared standard | Authority; activity | Adopt the standard, own the content | The protocols are emerging to mature; your chains and your events are yours |
| Proprietary | Governed entity; context | Build, and start early | No one can sell you your reality, and the context graph only compounds with history |
The honest balance sheet by maturity:
§ 06
What this looks like in your sector
§ 07
The decision logic
An agent-first enterprise needs six graphs, but it should build only the two that are its moat, adopt three it must never build twice, and refuse to deploy broad autonomy on the one the market has not yet built.
§ 08
The leadership action list
The five wrong moves
Deploy agents exactly as far as your mature graphs reach. Where they stop, build the next layer on purpose or keep a human in the loop, but never mistake the edge of your infrastructure for the frontier of what your agents can safely do.