Build1 publisher2 min readPublished
An agent has to make a second call before it can date IP Fabric's path answer
Michael Aragon, a solution architect at IP Fabric, told Lets Data Science that the platform computes the reachability verdict and the assistant only chooses the query and explains the result. An engineer still has to review that choice.
The Engineer · Build desk

What happened
- Michael Aragon, a solution architect at IP Fabric, used a written interview with Lets Data Science to set out the checks a team should run before relying on an AI assistant's account of the network.
- IP Fabric pairs application information with a digital twin of network configuration and behaviour, and its Model Context Protocol interface lets an AI assistant request information from that model.
- In a follow-up supplied to Lets Data Science, Aragon said path lookups and table queries do not carry a freshness indicator, so the agent needs a separate health-check call to establish the snapshot's age.
- Aragon said IP Fabric cannot independently discover the application information it needs, so that context arrives from Illumio or from inputs such as CSV files and APIs, with Illumio optional.
- The interview accompanies the version 8.1 announcement, and the current release notes list version 8.1.3 as generally available on September 23.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost Application Infrastructure Mapping is a premium add-on requiring the AIM feature in the licence, so the mapping this whole evaluation rests on is a purchase the team has to justify before it can audit anything.
- constraint Reproducibility of the computed path does not extend to the question the assistant asked, so review has to cover query selection as well as the returned answer.
- exposure Whoever maintains the application inventory carries the risk into every answer, because conflicting source IPs go unflagged and a status column showing an attempted lookup can be read as a successful one.
- decision Teams weighing an infrastructure agent now have a concrete acceptance test to run first: known-answer applications, one controlled change, and a deliberately missing dependency to see whether the agent notices.
Aragon's worked example is a mailing application with connectivity problems, where the engineer wants the infrastructure it depends on and the routing or security controls that might stop it reaching a destination [21]. Three results look similar in a transcript and mean different things on the wire. A source missing from the discovered network can produce an error, and that error tells the agent the lookup failed without establishing why [9]. A path can also appear to have been forwarded successfully and end at transit, with no warning that the destination is missing or invisible, and a default route can make an unreachable destination look like an ordinary Internet path [10]. A modelled block looks different. Aragon said the path should stop at a device and show dropped traffic on an edge, which he distinguishes from merely reaching the limit of the model's visibility [11].
On who decides what, Aragon told LDS: "The reachability verdict itself, though, still comes from IP Fabric's computation rather than the model's judgment" [3]. The assistant chooses what to ask and explains the result [4]. Those are two artifacts with different review needs. The computed path is evidence about the modelled network and reproduces on rerun; the query selection comes with no such guarantee [5].
IP Fabric's snapshot documentation describes records of network state at a particular time, and warns that comparing a partial snapshot with a full one can produce false positives because part of the network is missing [6]. The word verified has a narrow sense in Aragon's answers: application connectivity has been evaluated against the network model, a smaller claim than every fact needed for an operational decision being present and current [20]. An agent that never calls the health check will answer just as quickly about a snapshot collected last week.
His recommended checks include verifying the source IP and matching lookup ports to the flows table [13]. Both are manual work on the inputs, done before anyone reads the path result.
Two properties have to hold for the same evaluation to transfer to another MCP-fronted assistant. The platform, not the model, has to compute the verdict, which is the split Aragon claims for IP Fabric [3]. The collection time has to be retrievable by a call the agent can make, because freshness here is an operator action: teams schedule collection, trigger a snapshot or refresh the relevant devices [8]. Where either property fails, the reviewer has only the assistant's own text to check against. The checks are Aragon's own, published in a written interview with Lets Data Science, with no independent test of them in the material [1].
What to watch
- Whether IP Fabric puts snapshot age into path lookup and table query responses, removing the separate health-check call.
- Whether the AIM status column starts distinguishing an attempted lookup from a successful one, and whether conflicting source IPs get flagged.
- An independent run of Aragon's evaluation on a network where the missing dependency was seeded on purpose.