What This Example Shows
- A
GraphWorkflowmodeling the analyst workflow used inside intelligence shops: ingest, parallel analysis, red team, synthesis - Three parallel domain analysts (Geopolitical, Cyber, Open-Source HUMINT) running concurrently against the same packet
- A dedicated Red Team agent whose only job is to attack the analysts’ conclusions before they reach the brief
- A Synthesis Editor that produces a structured PIR-style executive brief tagged with confidence levels (HIGH / MODERATE / LOW)
- How to scale the same pipeline overnight across a 200-report inbox with concurrent requests to
/v1/graph-workflow/completions
Why This Matters
Every morning, analysts in defense, intelligence, and corporate-security shops face the same job: triage an overnight firehose of open-source reporting — news wires, regional press, vendor threat feeds, social signal, technical indicators — and turn it into a single brief that a principal will read in under five minutes. Most of the day is spent reading, not reasoning. This pipeline does the reading in parallel, runs a red team against itself, and hands the analyst a draft brief with confidence levels they can edit and sign — turning a six-hour triage cycle into a fifteen-minute review.Step 1: Setup
Step 2: Define the Pipeline
The graph models how a real watch floor works. The intake agent normalizes the raw packet. Three analysts attack it in parallel from different tradecraft angles. A red team agent challenges them. A synthesis editor produces the final brief.Step 3: Run a Single Report
A realistic input packet is a concatenation of normalized headlines, vendor advisories, and social signal pulled from your collection tooling. For this tutorial we use a synthetic packet so the example is runnable end-to-end.The Red Team agent never produces a final judgment — it produces a list of challenges that the Synthesis Editor must explicitly address. This is the analytic discipline IC analysts call “structured analytic techniques”: you cannot get to the brief without first surviving your strongest critic.
Step 4: Run the Full Overnight Inbox in Parallel
A real watch floor does not run one packet at a time. It runs the whole inbox between midnight and 0500Z so the brief is on desks at 0700. Fan out the same pipeline across every packet with concurrent requests to/v1/graph-workflow/completions.
Each graph workflow runs as its own request, so the fan-out happens client-side with a thread pool. (
/v1/swarm/batch/completions accepts a list of standard swarm specifications — it does not run graph workflows.) For 200 packets this typically completes in well under an hour — overnight is more than enough buffer for the morning brief cycle.Step 5: Audit Trail and Cost Reconciliation
Procurement and IG reviews almost always ask the same two questions: who ran what, and what did it cost. Two endpoints answer both.Cost vs. a Human Triage Cycle
Real numbers. A typical analyst (fully-loaded GS-13 or contractor equivalent at roughly $120/hour) spends six hours triaging an overnight inbox of 200 open-source reports — about $720 of labor per morning, per analyst, and most shops staff two to three on the cycle. Running this pipeline across the same 200-report inbox via concurrent
/v1/graph-workflow/completions requests typically lands in the low tens of dollars range total, and produces a draft brief the analyst signs in fifteen minutes instead of writing from scratch. The analyst is still in the loop — but the loop is review-and-sign, not read-and-write.Next Steps
- Graph Workflow Example — more parallel + sequential patterns
- Batch Swarm Completions — scale any swarm across a full inbox
- Swarm Logs & API History — pull the audit trail for compliance reviews