Three failure modes that compound silently in traditional identity infrastructure.
When an identity system merges two records, the pre-merge state is gone. The original evidence basis that justified keeping them separate is overwritten. Re-running an old query does not give you the old answer — it gives you whatever the current graph says.
Most systems force a decision at the cluster boundary: match or no-match. Evidence that falls below the threshold is discarded, not preserved as underdetermined. The result is a confidence interval collapsed to a boolean — with no record of what was sacrificed.
Contradictory attributes — two dates of birth, conflicting nationalities, incompatible relationship edges — are resolved by winner-takes-all. The losing evidence disappears without a trace. Reviewers see only the winner and cannot interrogate what disagreed.
A merge is a recomposition event over the permanent mention graph — not a data mutation. The pre-merge cluster boundary remains addressable at any prior graph version. A split redraws the boundary without touching the underlying mentions. Both operations are fully replayable.
Cluster decisions return structured uncertainty on two independent axes: coherence (is there disqualifying evidence?) and certainty (is there enough qualifying evidence?). Blocking evidence and resolving attributes are fields in the response — not threshold knobs to tune blindly.
Conflicting evidence is typed and preserved, not silently reconciled. When two sources disagree on an attribute, both are retained with full provenance. The conflict surface is visible in the API response — reviewers see what disagreed and why, not just the current winner.
The same engine handles attributes and relationships without a separate codepath for "who is X" versus "what does X do." Relationship evidence feeds identity resolution directly — so a director edge can narrow or widen a cluster boundary the same way a name match does.
When new evidence bridges two clusters, the engine reshapes the boundary as a recomposition event — not a data mutation. The pre-merge cluster versions remain addressable through the append-only evidence layer. Pin a session to T₀ and the old clusters resolve exactly as they did before the merge.
This is what makes investigations replayable, audits defensible, and agentic pipelines safe to act on: the answer Kloom returns is grounded in an evidence record that no subsequent operation can retroactively alter.
“Most identity systems destroy data when they reconcile. Kloom does not — and that is what makes investigations replayable.”
The append-only substrate the cluster layer operates over. Every mention, attribute, and relationship — permanently addressable. Blocking evidence and resolving attributes returned inline.
Read the pageDeterministic session pinning over the permanent graph. Pin an investigation to a graph version and it resolves identically against the same evidence basis weeks or months later.
Read the pageThe structured uncertainty surface the cluster layer produces — coherence, certainty, blocking evidence — shaped as a tool-callable API surface for agentic compliance and investigative pipelines.
Read the pageThirty minutes with engineering. We walk the cluster layer live, show a merge event with prior-state recall, and demonstrate how the evidence record survives any subsequent operation on the graph.