Use Cases: Enterprise Search, RAG & AI Agents¶

-- Document store with full-text index
DEFINE ANALYZER english_analyzer TOKENIZERS blank, class
    FILTERS lowercase, snowball(english);

DEFINE TABLE kb_doc SCHEMAFULL;
DEFINE FIELD title       ON kb_doc TYPE string;
DEFINE FIELD content     ON kb_doc TYPE string;
DEFINE FIELD entities    ON kb_doc TYPE array<string>;
DEFINE FIELD embedding   ON kb_doc TYPE array<float>;
DEFINE INDEX idx_kb_content ON kb_doc FIELDS content
    FULLTEXT ANALYZER english_analyzer BM25(1.2, 0.75);

CREATE kb_doc:1 SET title = 'Kubernetes Security Hardening',
    content = 'Container orchestration security requires proper RBAC, network policies, and pod security standards.',
    entities = ['http://example.org/kubernetes', 'http://example.org/rbac',
                'http://example.org/container_security'],
    embedding = [0.82, 0.15, 0.91, 0.03];
CREATE kb_doc:2 SET title = 'RBAC Best Practices',
    content = 'Role-based access control should follow the principle of least privilege across all services.',
    entities = ['http://example.org/rbac', 'http://example.org/access_control'],
    embedding = [0.79, 0.12, 0.88, 0.05];
CREATE kb_doc:3 SET title = 'CI/CD Pipeline Security',
    content = 'Secure your continuous integration pipeline with code signing, dependency scanning, and SBOM generation.',
    entities = ['http://example.org/cicd', 'http://example.org/supply_chain_security'],
    embedding = [0.45, 0.80, 0.60, 0.10];

-- Query the knowledge graph for related concepts
LET $related = SPARQL("
    PREFIX ex:   <http://example.org/>
    PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
    SELECT ?related WHERE {
        ex:rbac skos:related ?related .
    }
");
-- Returns: access_control, kubernetes (via SKOS relationships in the ontology)

-- Boost search: text match + entity overlap with knowledge graph
LET $search_entities = array::concat(
    ['http://example.org/rbac'],
    $related.map(|$r| $r.related)
);

SELECT title,
    search::score(0) AS text_score,
    array::intersect(entities, $search_entities) AS matched_entities,
    array::len(array::intersect(entities, $search_entities)) AS entity_boost
FROM kb_doc
WHERE content @0@ 'access control security'
ORDER BY (search::score(0) + array::len(array::intersect(entities, $search_entities)) * 0.5) DESC;
-- RBAC Best Practices ranks highest (text match + entity overlap)

-- Facet expansion: when user selects "Application Security",
-- also include child concepts in the filter
LET $facet_iris = SPARQL("
    PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
    PREFIX ex:   <http://example.org/>
    SELECT ?concept ?label WHERE {
        GRAPH <http://example.org/taxonomy> {
            ex:app_security skos:narrower* ?concept .
            ?concept skos:prefLabel ?label .
        }
    }
");
-- Returns: Application Security, OWASP Top 10, Secure Coding

-- Apply expanded facet to document search
SELECT title, search::score(0) AS score
FROM kb_doc
WHERE content @0@ 'security'
  AND entities CONTAINSANY $facet_iris.map(|$f| 'http://example.org/' + string::replace(string::lowercase($f.label), ' ', '_'))
ORDER BY score DESC;

DEFINE TABLE article SCHEMAFULL;
DEFINE FIELD title      ON article TYPE string;
DEFINE FIELD content    ON article TYPE string;
DEFINE FIELD entity_iri ON article TYPE string;

CREATE article:1 SET title = 'IndentiaDB Performance Benchmark',
    content = 'IndentiaDB achieves sub-millisecond SPARQL query latency on 100M triples.',
    entity_iri = 'http://example.org/indentiadb';
CREATE article:2 SET title = 'SurrealDB vs Traditional RDBMS',
    content = 'SurrealDB multi-model approach eliminates the need for separate databases.',
    entity_iri = 'http://example.org/surrealdb';

-- Search and enrich with entity card from knowledge graph
LET $results = SELECT title, content, entity_iri FROM article;

FOR $doc IN $results {
    LET $entity = SPARQL("
        PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
        PREFIX ex:   <http://example.org/>
        SELECT ?label ?description ?website ?category WHERE {
            <" + $doc.entity_iri + "> rdfs:label ?label .
            OPTIONAL { <" + $doc.entity_iri + "> ex:description ?description }
            OPTIONAL { <" + $doc.entity_iri + "> ex:website ?website }
            OPTIONAL { <" + $doc.entity_iri + "> ex:category ?category }
        }
    ");

    RETURN {
        title: $doc.title,
        content: $doc.content,
        entity_card: $entity[0]
    };
};
-- Each result includes an entity_card with label, description, website, category

-- Document search scoped to tenant
DEFINE TABLE tenant_doc SCHEMAFULL;
DEFINE FIELD title     ON tenant_doc TYPE string;
DEFINE FIELD content   ON tenant_doc TYPE string;
DEFINE FIELD tenant_id ON tenant_doc TYPE string;
DEFINE FIELD embedding ON tenant_doc TYPE array<float>;

CREATE tenant_doc:1 SET title = 'Acme Security Handbook',
    content = 'All employees must complete annual security awareness training.',
    tenant_id = 'acme', embedding = [0.8, 0.2, 0.5, 0.1];
CREATE tenant_doc:2 SET title = 'Globex Operations Manual',
    content = 'Standard operating procedures for the engineering department.',
    tenant_id = 'globex', embedding = [0.3, 0.7, 0.4, 0.2];

-- Tenant-scoped vector search
SELECT title,
    vector::similarity::cosine(embedding, [0.75, 0.25, 0.45, 0.12]) AS score
FROM tenant_doc
WHERE tenant_id = 'acme'
ORDER BY score DESC;
-- Only returns Acme documents

-- Combine with tenant's RDF knowledge graph
LET $policies = SPARQL("
    PREFIX ex: <http://example.org/>
    SELECT ?title ?classification WHERE {
        GRAPH <http://example.org/tenant/acme> {
            ?p a ex:Policy ;
               ex:title ?title ;
               ex:classification ?classification .
        }
    }
");
-- Returns only Acme's policies — Globex data is invisible

DEFINE ANALYZER legal_analyzer TOKENIZERS blank, class
    FILTERS lowercase, snowball(english);

DEFINE TABLE regulation SCHEMAFULL;
DEFINE FIELD title   ON regulation TYPE string;
DEFINE FIELD content ON regulation TYPE string;
DEFINE FIELD reg_iri ON regulation TYPE string;
DEFINE INDEX idx_reg_content ON regulation FIELDS content
    FULLTEXT ANALYZER legal_analyzer BM25(1.2, 0.75);

CREATE regulation:1 SET title = 'GDPR Article 17 - Right to Erasure',
    content = 'The data subject shall have the right to obtain from the controller the erasure of personal data without undue delay.',
    reg_iri = 'http://example.org/gdpr/art17';
CREATE regulation:2 SET title = 'GDPR Article 25 - Data Protection by Design',
    content = 'The controller shall implement appropriate technical and organisational measures for data protection.',
    reg_iri = 'http://example.org/gdpr/art25';
CREATE regulation:3 SET title = 'ISO 27001 A.8.2 - Information Classification',
    content = 'Information shall be classified in terms of legal requirements, value, criticality and sensitivity.',
    reg_iri = 'http://example.org/iso27001/a82';

-- Search for "data erasure" and enrich with compliance graph context
LET $search_results = SELECT title, reg_iri, search::score(0) AS score
    FROM regulation
    WHERE content @0@ 'data erasure'
    ORDER BY score DESC;

-- For each result, fetch related controls and implementation guidance from RDF
FOR $reg IN $search_results {
    LET $context = SPARQL("
        PREFIX comp: <http://example.org/compliance/>
        PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
        SELECT ?control ?status ?implementedBy WHERE {
            ?ctrl comp:implements <" + $reg.reg_iri + "> ;
                  rdfs:label ?control ;
                  comp:status ?status .
            OPTIONAL { ?ctrl comp:implementedBy ?implementedBy }
        }
    ");

    RETURN {
        title: $reg.title,
        score: $reg.score,
        controls: $context
    };
};
-- Returns search results annotated with compliance control status

-- Chunk store with vector embeddings
DEFINE TABLE chunk SCHEMAFULL;
DEFINE FIELD doc_id    ON chunk TYPE string;
DEFINE FIELD text      ON chunk TYPE string;
DEFINE FIELD embedding ON chunk TYPE array<float>;
DEFINE FIELD entities  ON chunk TYPE array<string>;

CREATE chunk:1 SET doc_id = 'doc_arch',
    text = 'The authentication service uses OAuth2 with PKCE flow for all client applications.',
    embedding = [0.85, 0.10, 0.72, 0.03],
    entities = ['http://example.org/oauth2', 'http://example.org/auth_service'];
CREATE chunk:2 SET doc_id = 'doc_arch',
    text = 'Session tokens are stored in Redis with a 30-minute TTL and encrypted at rest.',
    embedding = [0.80, 0.15, 0.70, 0.05],
    entities = ['http://example.org/redis', 'http://example.org/session_management'];
CREATE chunk:3 SET doc_id = 'doc_ops',
    text = 'The API gateway routes requests to backend microservices based on path prefix matching.',
    embedding = [0.40, 0.85, 0.30, 0.10],
    entities = ['http://example.org/api_gateway', 'http://example.org/microservices'];

-- Step 1: Retrieve relevant chunks via vector search
LET $query_embedding = [0.83, 0.12, 0.71, 0.04];
LET $chunks = SELECT text, entities,
    vector::similarity::cosine(embedding, $query_embedding) AS score
FROM chunk
ORDER BY score DESC
LIMIT 3;

-- Step 2: Extract unique entities from retrieved chunks
LET $entity_iris = array::distinct(array::flatten($chunks.map(|$c| $c.entities)));

-- Step 3: Fetch structured facts from knowledge graph for those entities
LET $facts = SPARQL("
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    PREFIX ex:   <http://example.org/>
    SELECT ?entity ?label ?description ?dependsOn ?version WHERE {
        VALUES ?entity { <http://example.org/oauth2> <http://example.org/auth_service>
                         <http://example.org/redis> <http://example.org/session_management> }
        ?entity rdfs:label ?label .
        OPTIONAL { ?entity ex:description ?description }
        OPTIONAL { ?entity ex:dependsOn ?dep . ?dep rdfs:label ?dependsOn }
        OPTIONAL { ?entity ex:version ?version }
    }
");

-- Step 4: Assemble RAG context for the LLM
RETURN {
    retrieved_chunks: $chunks.map(|$c| $c.text),
    knowledge_graph_facts: $facts,
    prompt_context: "Use the following document excerpts and knowledge graph facts to answer the question."
};

-- User asks about "authentication security"
-- Step 1: Find related concepts in the ontology (1-hop expansion)
LET $expanded = SPARQL("
    PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
    PREFIX ex:   <http://example.org/>
    SELECT ?related ?label WHERE {
        ex:authentication (skos:related | skos:broader | skos:narrower) ?related .
        ?related rdfs:label ?label .
    }
");
-- Returns: oauth2, session_management, mfa, rbac

-- Step 2: Retrieve chunks that mention any of these expanded concepts
LET $expanded_iris = $expanded.map(|$r| $r.related);

SELECT text, entities,
    vector::similarity::cosine(embedding, [0.83, 0.12, 0.71, 0.04]) AS vector_score,
    array::len(array::intersect(entities, $expanded_iris)) AS graph_relevance
FROM chunk
ORDER BY (vector_score + graph_relevance * 0.3) DESC
LIMIT 5;
-- Retrieves chunks about OAuth2, sessions, AND authentication
-- even if their embeddings aren't the closest match

-- Use multi-hop results as RAG context alongside vector search
LET $graph_context = SPARQL("
    PREFIX ex:   <http://example.org/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?dep ?team ?lead WHERE {
        GRAPH <http://example.org/cmdb> {
            ex:auth_service ex:dependsOn ?dep .
            ?dep ex:ownedBy ?t . ?t rdfs:label ?team .
            ?t ex:teamLead ?l . ?l rdfs:label ?lead .
        }
    }
");

LET $vector_chunks = SELECT text,
    vector::similarity::cosine(embedding, $query_vec) AS score
FROM chunk
WHERE entities CONTAINS 'http://example.org/auth_service'
ORDER BY score DESC LIMIT 5;

RETURN {
    graph_facts: $graph_context,
    document_chunks: $vector_chunks.map(|$c| $c.text),
    context_type: "multi-hop graph + vector retrieval"
};

-- Retrieve facts WITH provenance for RAG context
LET $facts_with_sources = SPARQL("
    PREFIX ex:  <http://example.org/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?subject ?predicate ?object ?source ?confidence ?verified WHERE {
        ?subject ?predicate ?object .
        << ?subject ?predicate ?object >>
            ex:source ?source ;
            ex:confidence ?confidence ;
            ex:lastVerified ?verified .
        FILTER (?confidence >= 0.85)
        FILTER (?subject = ex:indentiadb)
    }
    ORDER BY DESC(?confidence)
");

-- Build a citeable RAG context
RETURN {
    facts: $facts_with_sources,
    instruction: "When using these facts in your answer, cite the source. Only use facts with confidence >= 0.85."
};

-- Three-signal retrieval for question: "How does IndentiaDB handle SPARQL query optimization?"

-- Signal 1: Vector similarity (semantic match)
LET $vec_results = SELECT id, text, entities,
    vector::similarity::cosine(embedding, $query_embedding) AS score
FROM chunk
ORDER BY score DESC LIMIT 10;

-- Signal 2: BM25 full-text (keyword match)
LET $bm25_results = SELECT id, text,
    search::score(0) AS score
FROM chunk
WHERE text @0@ 'SPARQL query optimization'
ORDER BY score DESC LIMIT 10;

-- Signal 3: Knowledge graph facts (structured match)
LET $kg_facts = SPARQL("
    PREFIX ex:   <http://example.org/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?feature ?description WHERE {
        ex:indentiadb ex:hasFeature ?f .
        ?f rdfs:label ?feature ;
           ex:description ?description .
        FILTER (CONTAINS(LCASE(?feature), 'sparql') || CONTAINS(LCASE(?feature), 'optimization'))
    }
");

-- Reciprocal Rank Fusion: combine all three signals
-- Application layer computes RRF scores; here we assemble the raw signals
RETURN {
    vector_hits: $vec_results,
    bm25_hits: $bm25_results,
    kg_facts: $kg_facts,
    fusion_strategy: "reciprocal_rank_fusion",
    k: 60
};

-- Agent query: "What open tickets does Acme Corp have and which products are affected?"
LET $result = SPARQL("
    PREFIX ex:   <http://example.org/agent/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?customer ?ticket ?product ?priority WHERE {
        GRAPH <http://example.org/agent/data> {
            ?c a ex:Customer ;
               rdfs:label ?customer ;
               ex:hasTicket ?t .
            ?t rdfs:label ?ticket ;
               ex:relatedToProduct ?p ;
               ex:status 'Open' ;
               ex:priority ?priority .
            ?p rdfs:label ?product .
        }
    }
");
-- Returns: Acme Corp, "SPARQL query timeout on large dataset", IndentiaDB Enterprise, High
RETURN $result;

-- Agent needs: "find relationships between entities" -> select the best tool
LET $tools = SPARQL("
    PREFIX tool: <http://example.org/tools/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?tool ?label ?cost ?latency WHERE {
        GRAPH <http://example.org/agent/tools> {
            ?tool a tool:Tool ;
                  rdfs:label ?label ;
                  tool:capability tool:cap_relationship ;
                  tool:costPerCall ?cost ;
                  tool:avgLatencyMs ?latency .
        }
    }
    ORDER BY ?cost
");
-- Returns: Knowledge Graph Query (cheapest, fastest for relationship queries)
RETURN $tools;

-- Agent task log (document store)
DEFINE TABLE agent_finding SCHEMALESS;

CREATE agent_finding:1 SET
    agent_id = 'research_agent',
    timestamp = d'2026-03-23T10:00:00Z',
    finding = 'Customer Acme Corp reported 3 incidents this month',
    entity_iri = 'http://example.org/agent/cust_001',
    confidence = 0.95;

CREATE agent_finding:2 SET
    agent_id = 'analysis_agent',
    timestamp = d'2026-03-23T10:01:00Z',
    finding = 'Acme incidents correlate with v2.1 database upgrade',
    entity_iri = 'http://example.org/agent/prod_db',
    confidence = 0.82;

-- Synthesis agent: gather all findings about a customer and their products
LET $all_findings = SPARQL("
    PREFIX ex:   <http://example.org/agent/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?agent ?finding ?confidence ?related WHERE {
        GRAPH <http://example.org/agent/shared> {
            ?f a ex:AgentFinding ;
               ex:discoveredBy ?agent ;
               ex:finding ?finding ;
               ex:confidence ?confidence .
            {
                ?f ex:about ex:cust_001 .
            } UNION {
                ?f ex:about ?prod .
                ex:cust_001 ex:purchasedProduct ?prod .
            }
            OPTIONAL { ?f ex:relatedFinding ?rel . ?rel ex:finding ?related }
        }
    }
    ORDER BY DESC(?confidence)
");

-- The synthesis agent now has cross-agent context to formulate a response
RETURN $all_findings;

-- Episodic memory: conversation events (document store, append-only)
DEFINE TABLE episode SCHEMALESS;

CREATE episode SET
    agent_id = 'assistant_01',
    session_id = 'session_abc',
    timestamp = d'2026-03-23T14:00:00Z',
    role = 'user',
    content = 'What products does Acme Corp use?',
    intent = 'product_inquiry';

CREATE episode SET
    agent_id = 'assistant_01',
    session_id = 'session_abc',
    timestamp = d'2026-03-23T14:00:02Z',
    role = 'assistant',
    content = 'Acme Corp uses IndentiaDB Enterprise v2.1 and IndentiaSearch v1.4.',
    tools_used = ['knowledge_graph'],
    entities_mentioned = ['http://example.org/agent/cust_001',
                          'http://example.org/agent/prod_db',
                          'http://example.org/agent/prod_search'];

-- When a new conversation starts, load both memory types
-- Episodic: recent conversations with this customer
LET $recent_episodes = SELECT content, timestamp, role
    FROM episode
    WHERE entities_mentioned CONTAINS 'http://example.org/agent/cust_001'
    ORDER BY timestamp DESC LIMIT 10;

-- Semantic: learned facts about this customer
LET $semantic_memory = SPARQL("
    PREFIX ex:   <http://example.org/agent/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?label ?lastInteraction ?sentiment ?concern WHERE {
        GRAPH <http://example.org/agent/memory> {
            ex:cust_001 ex:lastInteraction ?lastInteraction ;
                        ex:sentiment ?sentiment ;
                        ex:primaryConcern ?concern .
        }
        GRAPH <http://example.org/agent/data> {
            ex:cust_001 rdfs:label ?label .
        }
    }
");

RETURN {
    episodic: $recent_episodes,
    semantic: $semantic_memory,
    context: "Use episodic memory for conversation continuity, semantic memory for customer understanding."
};

-- Question: "Why is the API service degraded?"
-- Agent strategy: traverse dependency graph to find root cause

-- Step 1: Get the service and its dependencies
LET $deps = SPARQL("
    PREFIX cmdb: <http://example.org/cmdb/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?service ?dependency ?depLabel WHERE {
        GRAPH <http://example.org/cmdb> {
            cmdb:svc_api cmdb:dependsOn+ ?dependency .
            ?dependency rdfs:label ?depLabel .
        }
    }
");
-- Returns: svc_database, svc_cache, and their transitive dependencies

-- Step 2: Check health status for each dependency
LET $health = SELECT service_iri, status, latency_ms, error_rate
    FROM service_health
    WHERE service_iri IN $deps.map(|$d| $d.dependency)
      AND timestamp >= d'2026-03-23T13:00:00Z'
    ORDER BY error_rate DESC;

-- Step 3: Find recent incidents linked to unhealthy services
LET $incidents = SPARQL("
    PREFIX cmdb: <http://example.org/cmdb/>
    PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
    SELECT ?incident ?severity ?rootCause WHERE {
        GRAPH <http://example.org/cmdb> {
            ?inc a cmdb:Incident ;
                 rdfs:label ?incident ;
                 cmdb:affectsService cmdb:svc_api ;
                 cmdb:severity ?severity ;
                 cmdb:rootCause ?rc .
            ?rc rdfs:label ?rootCause .
            FILTER NOT EXISTS { ?inc cmdb:status 'Resolved' }
        }
    }
");

-- Step 4: Assemble reasoning chain
RETURN {
    question: "Why is the API service degraded?",
    dependency_chain: $deps,
    health_status: $health,
    active_incidents: $incidents,
    reasoning: "Traversed dependency graph -> checked health metrics -> found active incidents -> identified root cause"
};