Ontology and Knowledge Graph Visualizer

KnowledgeGraph Visualizer - Production Readiness and User Guide

A Confluence-ready guide for stakeholders, managers, developers, testing teams, and data stewards who need to understand, operate, validate, and use the KnowledgeGraph Visualizer to browse Neptune graph data.

Document version: 1.0 | Last updated: June 7, 2026

Executive Summary

Amazon Neptune stores the enterprise knowledge graph, but users need a business-friendly and application-specific way to browse the ontology, inspect relationships, search resources, validate graph structure, and share findings. The KnowledgeGraph Visualizer was built to fill that gap.

The tool provides a visual graph exploration layer over Neptune data. Users can search by label, URI, or resource type, select a node, view its connected neighborhood, inspect properties and relationships, run approved governance checks, and validate that Neptune data is usable for business and technical workflows.

The browser never connects directly to Neptune. The web app calls the Choreo-hosted backend service, and the backend service signs Neptune requests using AWS IAM SigV4.

Page Contents

1. Why This Tool Was Built 2. Audience Guide 3. How To Use The Tool 4. Architecture Diagrams 5. Development And Production Environment Model 6. Production Readiness Requirements 7. Security Model 8. Testing And UAT Plan 9. Operations And Support 10. Reference Links

Why This Tool Was Built

Business Problem

Neptune is the graph data store, but a graph database endpoint by itself is not enough for day-to-day discovery. Business users, managers, testers, and data stewards need a visual way to understand how concepts, policies, entities, documents, coverage terms, and relationships are connected.

Without this tool, teams must rely on raw SPARQL queries, local TTL files, or developer-assisted exports. That slows down validation, makes demos harder, and limits visibility into the graph.

Solution

The KnowledgeGraph Visualizer adds an application-specific visualization and governance layer on top of Neptune. It turns graph data into searchable, inspectable, and shareable views.

The tool is designed to help teams see the graph rather than only query the graph. This helps stakeholder review, data quality checks, ontology development, and production readiness validation.

User Journey

KnowledgeGraph Visualizer user journey Mermaid PNG diagram

High-level journey from opening the application through search, graph inspection, governance checks, and sharing findings.

Audience Guide

Managers And Stakeholders

Use this page to understand why the tool exists, what business value it provides, and what must be true before production rollout.

Developers

Use this page to understand architecture, service boundaries, Choreo runtime settings, Neptune integration, and production guardrails.

Testing Team

Use this page to plan UAT, smoke tests, regression checks, Neptune connectivity validation, and graph browsing scenarios.

Data Stewards

Use this page to inspect ontology structure, verify relationship quality, review governance findings, and confirm data usability.

How To Use The Tool To Browse Neptune Data

  1. Open the Choreo-hosted web application URL for the correct environment.
  2. Confirm the Neptune badge shows connected. If it shows disconnected, use /api/neptune-status or the support section below.
  3. Use the Neptune search box to search by business label, URI fragment, ontology class, policy term, or resource type.
  4. Select a search result to render the graph neighborhood for that resource.
  5. Use the graph controls to fit, zoom, switch layout, export PNG, or expand related nodes.
  6. Click nodes to inspect labels, types, data properties, object relationships, and incoming links.
  7. Use governance and validation views to review warnings, data quality concerns, and ontology structure.
  8. Share findings with screenshots, graph exports, resource URIs, or validation notes.

Expected User Outcomes

User Goal What The Tool Provides
Understand graph relationships Interactive node-link visualization of Neptune-backed resources and relationships.
Find business concepts quickly Search by labels, URI fragments, resource types, and graph terms.
Validate data quality Ontology stats, validation results, SHACL-related summaries, and governance query views.
Support demos and reviews Visual graph browsing, PNG export, and resource-level inspection.

Architecture Diagrams

The application uses a web app and backend service boundary. The browser calls Choreo, Choreo routes to the Python service, and only the Python service communicates with Neptune.

Development Architecture

Development architecture Mermaid PNG diagram for KnowledgeGraph Visualizer

Development uses the non-production Choreo web app and API gateway, a Python service component, Choreo configs/secrets, cached TTL files, optional S3 bulk load, and the development Neptune endpoint.

Production Architecture

Production architecture Mermaid PNG diagram for KnowledgeGraph Visualizer

Production should use authenticated browser access, production Choreo gateway controls, backend authorization, IAM role or workload identity for AWS access, strict CORS, and read-only defaults.

Development And Production Environment Model

Area Development Production
Purpose Feature validation, connectivity testing, data exploration, developer troubleshooting. Controlled business usage, approved graph browsing, governance review, operational validation.
Web app URL Development Choreo web app <production-web-app-url>
API base URL https://dev.nonprod.bt.choreoapis.dev/genai/knowledgegraph-visualizer/v1.0 <production-service-api-url>
Neptune endpoint dev-neptune-w.chubb.com:8182 <production-neptune-endpoint>:8182
AWS identity Temporary Choreo service secrets may be used during testing. IAM role or workload identity is preferred. Avoid manually pasted AWS session tokens.
CORS Development web app origin only. Production web app origin only. Do not use wildcard CORS in production.
Write/delete operations Allowed only for controlled testing. Disabled by default or restricted to approved admin users.

Required Production Information To Finalize

Information Needed Where To Find It Owner
Production web app URL and service API URL Choreo production components and endpoints Application or Choreo owner
Production Neptune endpoint, AWS account, and region AWS Neptune console, Route 53/internal DNS, cloud platform team Cloud/data platform team
IAM role ARN and policy permissions AWS IAM console, security/cloud team Cloud security team
User groups and access model Choreo auth configuration and enterprise identity provider Application owner and IAM team
Allowed production endpoints Security review and product owner approval Application owner

Production Readiness Requirements

Required Production Guardrail Needs Owner Confirmation

Go-Live Checklist

Readiness Area Requirement Status
Authentication Production users authenticate through approved Choreo/enterprise auth. Browser-side secrets are removed. Confirm
Authorization Read-only users and admin users are separated. Dangerous endpoints are not available to general users. Confirm
AWS access Service uses IAM role or workload identity, with least-privilege Neptune data access permissions. Confirm
Neptune connectivity /api/neptune-status returns configured: true and connected: true. Required
CORS Service allows only the production web app origin. Required
Feature flags Read-only mode is enabled unless admin workflows are explicitly approved. Required
Logging Logs include request IDs and error details but never secrets, access tokens, or AWS session tokens. Required
Support model Runbook, escalation path, and owner contacts are documented. Confirm

Recommended Production Feature Flags

APP_ENV=production
NEPTUNE_READ_ONLY=true
ENABLE_NEPTUNE_WRITES=false
ENABLE_DESTRUCTIVE_ENDPOINTS=false
ENABLE_SPARQL_WORKBENCH=false

Security Model

Production must not expose Choreo client secrets, API keys, AWS access keys, AWS secret keys, or AWS session tokens in browser files, screenshots, logs, wiki pages, or committed source code.

Security Principles

Principle Production Implementation
Backend trust boundary The browser calls the backend through Choreo. Only the backend signs Neptune requests.
Least privilege Read-only graph browsing should use read-only Neptune permissions. Write/admin actions require separate approval.
No browser secrets Browser runtime config should contain public URLs only. Avoid browser-side client credentials.
Controlled CORS Allow only approved web app origins for each environment.
Operational audit Capture gateway correlation IDs, Neptune request IDs, service status, and health check results.

Endpoint Classification

Endpoint Group Examples Production Access
Read-only browsing /api/neptune-status, /api/neptune-stats, /api/neptune-search, /api/neptune-describe, /api/neptune-explore Allowed for approved users.
Local ontology views /api/ontology, /api/validate, /api/reasoned, /api/inferred Allowed for approved users.
SPARQL workbench /api/sparql SELECT-only or restricted to advanced users.
Write/admin operations /api/neptune-insert, /api/neptune-delete, /api/neptune-sync, /api/neptune-bulk-load Admin-only if enabled. Disabled by default.
Destructive operations /api/neptune-drop-all, delete-resource workflows Disable in production unless explicitly approved with break-glass controls.

Testing And UAT Plan

Smoke Tests

Test Steps Expected Result
Application loads Open the web app URL. Home page loads with ontology stats and navigation.
Backend health Call /api/health. HTTP 200 and JSON health payload.
Neptune status Open Neptune tab or call /api/neptune-status. configured: true and connected: true.
Neptune stats Call /api/neptune-stats. Triple/class/individual/named graph counts return successfully.
Graph search Search for a known term such as Policy, Coverage, Carrier, or a known URI fragment. Search results appear, and selecting a result renders a graph neighborhood.
Governance view Open governance and validation areas. Approved checks load without backend errors.

Regression Test Areas

If Neptune returns AccessDeniedException and says the security token is invalid, the backend reached Neptune but the AWS signing identity was rejected. Validate AWS identity first, then Neptune IAM permissions.

Operations And Support

Operational Checks

Check Where Healthy Signal
Choreo web app availability Choreo Web App component Web app responds and serves the UI.
Service availability Choreo Service component and /api/health HTTP 200 with backend response.
Neptune connectivity /api/neptune-status and /api/neptune-connection-check DNS, TCP, AWS credentials, and Neptune status checks pass.
Gateway routing Choreo gateway logs Requests show BACKEND_RESPONSE and service path maps to /api/*.
Application errors Choreo application logs No repeated 403, 500, or connection timeout errors.

Common Issues

Symptom Likely Cause Action
Neptune badge says Not configured NEPTUNE_ENDPOINT missing or service did not restart after env update. Check Service component environment variables and redeploy/restart.
Neptune returns 403 invalid security token AWS credentials are invalid, mismatched, expired, or not usable from the service runtime. Run/verify STS caller identity from the same runtime; rotate credentials or fix IAM role setup.
Browser receives 401 from Choreo API Web app did not attach valid Choreo auth or API gateway credentials. Review web app auth model and Choreo connection configuration.
Browser CORS failure Service CORS allowlist does not include the web app origin. Set CORS_ALLOW_ORIGINS to the exact web app URL for that environment.
Graph view is empty after search Search term returned no connected resources, or Neptune query failed. Try a known URI/class and check service logs for Neptune errors.

Reference Links

Support Contact

In case of any issue with this application, Neptune graph browsing, Choreo deployment, or production readiness questions, please contact guptara@chubb.com.