The topology evidence model
How raw observations (LLDP/CDP/FDB/ARP/routes/vendor APIs/AI inference) become the derived topology graph, and why AI never converts an inference into verified truth.
Updated Aug 24, 2026Product 2026.97 minMSP operator, Internal IT, Developer
Raw observations to derived graph
Collectors upload raw, timestamped observation records — interfaces, VLANs, IP addresses, routes, LLDP/CDP neighbors, forwarding-table entries and subnets. AssurIQ never edits these raw records; it derives a topology graph of edges from them, each edge keeping a pointer back to the evidence that produced it.
| Protocol | What it proves | Verified? |
|---|---|---|
| LLDP / CDP | Direct physical adjacency reported by both devices | Yes |
| FDB (forwarding table) | A MAC address is reachable via a bridge port — not necessarily direct | No — inferred |
| ARP / routes | Layer-3 reachability, not physical wiring | No — inferred |
| Vendor API | Vendor-reported topology, trusted but not physically observed by AssurIQ | No — inferred |
| AI inference | Correlated from co-occurring signals when no direct protocol evidence exists | No — inferred, and always dashed |
Why AI inference never becomes verified truth
Human confirmation is the only path to verified
AssurIQ's AI inference layer proposes likely links and cleanup suggestions, but it never marks an edge verified. Only a human clicking Confirm on a specific suggestion sets verified = true, and that action is recorded with who and when.
This keeps AssurIQ from ever presenting a guess as physical fact, and keeps every verified edge auditable back to a real observation or a named human decision.
Error codes covered
Was this helpful?