Live · free · browser-local

Cartograph — design the outcome, not the behaviour

Every goal-driven system — an AI agent, a workflow, an autonomous service — is built to reach an outcome. And nearly every one of them is built backwards: we specify the behaviour and hope the outcome emerges. Prompts, policies, orchestration graphs — behaviour everywhere, and nowhere a drawing of the thing the system exists to produce.

Free · runs entirely in your browser · nothing you draw leaves your device

Outcomes are constrained by the lifecycle

Cartograph is built on BOLT — the strategy notation founded on one idea: every action connects a lower-value state to a higher-value one, so outcomes are constrained by the lifecycle. You cannot prompt your way to an outcome the lifecycle cannot reach. So you design the lifecycle first.

BOLT said it for businesses in 2012. An agent is that statement running in a loop, which is why the notation transferred without bending — the foundation is literally true of goal-driven software, not metaphorically.

Four diagrams, one shared model

Not four documents that drift. Four views over the same model, so a state you add in one is a state the others already know about.

01

System

Who and what participates in producing the outcome.

02

Outcome Lifecycle

The path from low value to the outcome, state by state.

Not a picture of the system; a source form for it.

03

Ecosystem

Where each state lives: your system → your sandbox → external tools like Slack → the untrusted world.

Your outcome usually depends on ground you do not operate.

04

Redline

The anti-outcomes: what must never happen, and where the door is.

Problems have two shapes

The method finds problems the way BOLT always has: every problem is a missing transition to a state you want, or an unwanted transition to one you don't.

The Redline diagram takes that to its limit — forbidden regions drawn as territory, bands ordered outward by danger, so the central claim is checkable by eye: no arrow crosses a contour except through a door.

Every finding shows its provenance

You asserted it, or the drawing implies it — the finding says which, and the difference is never blurred. A rank you set is your judgement; a gap in the graph is true of the drawing, not yet of the system.

you asserted it the drawing implies it an engine proved it — not yet not checked
The compile target. The model already carries what a proof needs: every state variable has a finite declared domain, every drawn state its assignment, every capability its tier and reversibility, every redline its predicate. That is what makes the fourth provenance mark possible at all.

Optionally assisted, never dependent

Bring your own API key and the built-in assistant critiques the diagram in front of you, suggests what's missing, and proposes changes you accept or dismiss. No key, and everything else still works.

1

Your key, your provider

The active diagram goes directly from your browser to the model provider you chose — never to any server of ours.

2

Proposals, not edits

Suggestions land as dashed additions you accept or dismiss. The assistant never commits a change on your behalf.

3

Findings run without it

The rule-based findings are not the assistant. Without a key they still run, and the provenance chips still tell you which is which.

It opens on a tutorial

Four diagrams that teach the notation — including two mistakes drawn on purpose, because a tool that can't draw the mistake can't find it. One is a door standing in open ground; the other is a transition that crosses a contour with no door at all. Both get flagged, and you can watch the violation clear as you fix it.

Questions

Is this an agent-security scanner?
No. It's a designer for systems defined by their outcomes; the redline is one of its four diagrams. The proving is PolySec's — Cartograph shows you what the engines said, or tells you they haven't been asked.
Why a strategy notation?
Because BOLT's foundation — every action connects a low-value state to a high-value one, and outcomes are constrained by the lifecycle — is literally true of goal-driven software, not metaphorically. The notation transferred without bending.
Only AI agents?
Anything built to reach an outcome: agents today, and the same drawings fit workflows and autonomous services — the compile target is a plain state machine.
Where does my model go?
Nowhere, by default. IndexedDB in your browser; export is a file download. The one exception is opt-in: if you configure the assistant with your own API key, the active diagram is sent directly from your browser to the model provider you chose — never to any server of ours.
What does the assistant do?
Suggest, critique, draft. It runs on your own key (Anthropic confirmed; the seam is provider-pluggable), its proposals land as dashed suggestions you accept or dismiss — never a committed change — and without a key the rule-based findings still run.

Open it

It seeds two starter projects and opens on the tutorial. Nothing to install, no account, no key required.

Design the outcome
cartograph
All tools →