Map the write paths.
Audit every role.
One deterministic graph of your Dynamics 365 and Dataverse environment: what writes every field, what each plugin is built to do, who can touch what.
Scan. Resolve. Act.
Scan
A read-only application user reads schema, registrations, and definitions. Never your record values.
Resolve
Every component parsed into one graph, including what the platform itself cannot interpret: compiled plugin IL, classic-workflow XAML, flow JSON.
Act
Findings ranked by severity, touchpoints ranked by salience, migrations sequenced. All of it callable by your agents over the MCP.
What do you want to do with it?
Every door draws from the same graph. The difference is the job, and the words for it.
Answer the questions you get every day, in seconds.
- What changed since the last scan, even what you didn't change
- Who can really write this field
- Touchpoints: every writer and reader of a column, ranked by salience
With AI on: hand an incident to an agent over the MCP and it traces what the change actually touches.
⤴ regressed · resolved earlier, currently open again
+1 new · the impersonation fails every time it fires
AI is optional and off by default. How Pathix uses AI →
One place for every environment.
Every scan rolls up here: what changed since you last looked, the findings and hotspots that need attention, and an honest read on what the scan could not resolve.
Severity, salience, and confidence stay apart.
Most tools collapse everything into one number. Blend these three and all three read wrong.
The security verdict
A deterministic check that fired, ranked Critical to Info. Findings only. Salience never enters this ordering.
Graph prominence, 0 to 100
How noisy a field or component is in the graph: how many things write it, whether it is sensitive, whether it sits next to a finding. It ranks what is prominent, not what is risky. A low score is not a safety verdict.
How Pathix knows each edge
Declared, pinned by platform structure. Parsed, resolved from the component's own logic. AI-derived, evidence-coupled and never overriding a deterministic edge. Unresolved, a write we found but could not trace to a column, shown rather than quietly dropped.
The real console, on sample data.
Not a mockup and not a video: the actual Pathix console, loaded with a sample environment. Click into a finding, open the touchpoints for a field, sort the hotspots by salience. Nothing to install, and no access to your tenant.
A low signal count is not “all clear.” Not everything is scannable, and Pathix tells you what it could not see.
Consultancies: land a paid assessment in hours, bid the migration fixed-price with the discovery risk measured instead of guessed, then stay on for delivery.
Pathix for consultancies →Self-hosted, read-only, metadata-only.
The boundaries are architectural, not promises. Deploy it in your own tenant, read the schema yourself, and check the exact read-only role before you grant it.
In your own Azure
Deploys into the customer's own subscription from a Bicep template and a guided wizard. Nothing about running it requires data to leave the tenant.
Read-only, metadata-only
A read-only application user. Pathix reads schema, registrations, and definitions, and never stores, transmits, or analyzes your business record values.
The AI tier holds the same line
Turn AI on with your own key and the metadata-only boundary still applies. Record values stay out of the AI path too.
See what Pathix finds in a real environment.
A 30-minute walkthrough on a pre-scanned demo environment. No access to your tenant, nothing to install. Bring the questions your current tools can't answer.