Separate audit paths from adaptive investigation
Deutsche Bank and Google Cloud report separate fixed and adaptive paths that share operational context and persistent review records.
Audit exercises and live investigations need different paths through the same evidence. Deutsche Bank and Google Cloud report a fixed path and an adaptive path. Both paths share operational context and persistent records.
Four terms keep the boundary clear:
- Fixed path: a set order of steps that every exercise follows.
- Adaptive path: a route that chooses steps as an investigation develops.
- Operational context: current facts about systems, dependencies, logs, incidents, alerts, and other operating signals.
- Audit record: saved evidence that shows what happened, what informed it, and what reviewers can inspect.
A fixed path makes lineage inspectable
Deutsche Bank and Google Cloud say the bank uses LangGraph for regulator-aligned exercises with a traceable, deterministic process. Deterministic means that the workflow follows predefined rules rather than inventing its route during the exercise.
This path turns operational context into scenarios with a known sequence. Reviewers can trace the route from the input context to the output. A fixed path earns its place when the exercise must show that every required stage ran.
An investigation needs room to change course
The same source says the bank uses Google Agent Development Kit for adaptive and investigative scenarios. This path can analyze current conditions and produce responses without a predefined execution route.
An investigation cannot know every useful step before it reads the first clue. Its controls must bound the available agents and tools while preserving each choice. Adaptation changes the route, not the need for a reviewable record.
Separate routes can share evidence
Deutsche Bank and Google Cloud report that both routes use a common intelligence layer. The same agents and tools can read architecture, data-flow diagrams, logs, and code artifacts across exercises and incident analysis.
Their reported architecture separates the execution models, while both paths persist the scenario, session artifacts, and review record. The comparison follows that first-party account:
| Path | Purpose | Execution rule |
|---|---|---|
| Fixed | Regulator-aligned resilience exercise | Predefined, traceable sequence with input-to-output lineage |
| Adaptive | Investigation and root-cause analysis | Chooses steps from current conditions without a predefined route |
A shared context layer does not require one execution rule. It gives each route the same factual base and keeps their records comparable. Teams can then connect exercise findings to incident analysis without forcing an investigation through an audit script. Both routes still need the guarantees that an audit harness enforces in code. A shared record helps only when deterministic checks decide what enters it.
The source sets a boundary, not a benchmark
Deutsche Bank and Google Cloud say the model now applies across multiple Deutsche Bank portfolios. That statement reports portfolio use. It gives no portfolio count, independent verification, measured performance result, reliability rate, review-time reduction, or evidence-quality score.
Deutsche Bank and Google Cloud neither use Muniment nor serve as its endorsers. Their case study supplies public architecture evidence. Muniment draws the operating conclusion from it.
A fixed audit path should stay fixed enough to inspect. An adaptive investigation should stay free enough to follow evidence. The durable link is the shared record, not a shared route.