Netflix describes an incident-investigation bottleneck: engineers spend hours reconstructing relationships between tools that name the same application differently. Its response is an ontology, a shared model of operational entities and their relationships. A knowledge graph connects those entities so engineers and AI agents can query across systems.

  • Validate identity first. Applications must match an authoritative catalog of roughly 49,000 entries. A service-like name found in a log cannot create an application by itself.
  • Keep the reasoning. The graph stores hypotheses, discarded explanations and successful mitigations from incident discussions alongside metrics, events, logs and traces.
  • Make enrichment ordered and best-effort. Each processing step adds typed facts for later steps. Sequential execution trades elapsed time for fewer races; unavailable downstream APIs leave a degraded graph.
  • Keep hypotheses attached to evidence. A correlation engine searches 13 signal types within a ten-minute window and discards chains scoring below 0.6. Those scores rank proposals for investigation.

The system uses RDF, a standard for linked facts; OWL for modeling concepts; SHACL for validating data; and SPARQL for graph queries. Netflix stores the graph in QuipuDB, its internal distributed store, and archives readable snapshots for debugging.

Its AutoRCA agents use the graph to assemble context and propose explanations. Engineers still assess the evidence and write the fix. Automated remediation and an integration with Netflix’s broader domain models remain future work.

A valid shape does not establish a true conclusion. The article describes constrained model outputs as producing determinism. A fixed graph can support repeatable queries, but a model can still choose different valid labels or resolve an identity incorrectly. Netflix provides an illustrative four-hour investigation, rather than measured before-and-after incident results or accuracy figures.

The 18-comment Hacker News discussion adds questions about identity maintenance and evidence of operational value.

What the thread adds

  • nout — “centralizing identity is critical” … “enable backtracing to sources for each triple”. The alternative proposed: “just let the AI poke the systems on its own via clean small interfaces.”
  • 1970-01-01 — “What happened to the 1.5s problem in the introduction?”
  • antonvs — “an ontology is a formal model of concepts in a domain, their properties and relationships, along with axioms or constraints that apply to those concepts.”

From an 18-comment thread, in HN’s own order.