A shared service account looks harmless in a manifest. In the production graph behind this series, one identity sat underneath more than a dozen workloads and several dozen pods, turning a small-looking edit into a cross-team production event.

Annie Graph turns that concern into a review you can reproduce: find the high-fan-in dependency, trace a structural path to an affected service, calculate its transitive blast radius, inspect the downstream call graph, and generate a Mermaid diagram for the pull request.

Find the dependency everyone shares

The high-level commands cover common operational paths. graph query gives you direct, deterministic access to the broader Graph API query language. Here it ranks service accounts by dependent workloads and pods:

$ annie graph query \
  'SELECT * FROM spof WHERE kind = serviceaccount LIMIT 10' \
  --output json |
  jq -r '
    (["NAME", "WORKLOADS", "PODS"] | @tsv),
    (.data.result.spof.items[] | [.name, .workloads, .pods] | @tsv)
  '
NAME                 WORKLOADS  PODS
shared-runtime-sa    14         24
deploy-reader-sa      4          7
metrics-agent-sa      2          3

The `spof` query reference, also available in the canonical `QUERY_LANGUAGE.md`, documents the kind filter, its accepted values and aliases, the optional namespace filter, and supported modifiers. You can inspect the same catalog without leaving the terminal:

$ annie graph query --describe spof

The ranking says nothing about whether shared-runtime-sa is misconfigured. Its fan-in is enough to require a wider review before changing it.

Trace the path, then calculate impact

graph path answers a narrow structural question first: can Annie connect the shared identity to the customer-facing service within five hops?

$ annie graph path shared-runtime-sa checkout-api

When the path exists, the output shows the resource chain and relationship names. When it does not, Annie returns a successful “not found within five hops” result instead of inventing a connection.

Now calculate transitive impact from the shared identity:

$ annie graph blast shared-runtime-sa --limit 100
Blast radius for shared-runtime-sa: 24 pods; showing 14 workloads and 12 services

KIND      NAME               NAMESPACE   AFFECTED PODS
workload  checkout-worker    commerce    4
workload  ledger-consumer    payments    3
service   checkout-api       commerce    4
service   ledger-api         payments    3

blast walks from the selected resource to affected pods, their owning workloads, and connected services. The reviewer can now name the teams required for approval, check whether the maintenance window covers customer-facing paths, and decide whether to split the change.

Values equal to --limit are bounded results. Read them as “at least this many,” not a fleet-wide total.

Follow the downstream service footprint

Blast radius starts from infrastructure. tree starts from an observed service and follows its downstream call graph, including datastore and external leaves:

$ annie graph tree checkout-api --limit 50
Service tree for checkout-api: 12 services, 9 datastores, 8 external dependencies
Cycle detected: the root service is reachable from its downstream call graph.

Services:
  pricing-api
  ledger-api
  notification-worker

Datastores:
  checkout-postgres
  sessions-redis

External dependencies:
  payment-provider

A call graph that loops back to its root can amplify retries and complicate failover. Service trees depend on observed service-call data; an unconfigured or empty source stays empty.

Put the generated Mermaid in the review

Start with the context view. It usually stays readable enough for a change review:

$ annie graph diagram checkout-api --level context > checkout-context.mmd
$ npx -p @mermaid-js/mermaid-cli mmdc \
  -i checkout-context.mmd \
  -o checkout-context.svg

The generated Mermaid source follows this shape:

flowchart TB
  checkout-api --> pricing-api
  checkout-api --> ledger-api
  checkout-api --> notification-worker
  checkout-api --> sessions-redis
  checkout-api --> payment-provider
  ledger-api --> checkout-postgres
Mermaid context diagram generated by Annie Graph, showing checkout-api connected to pricing and ledger services, a worker, two datastores, and external providers.

Use --level container when the review needs workloads, containers, queues, and datastores; component for deeper runtime and configuration detail; and dynamic for a sequence diagram of the observed call flow. In this example, context remained reviewable while container and component expanded into hundreds of elements.

Run the review before the edit

$ annie graph query 'SELECT * FROM spof WHERE kind = serviceaccount LIMIT 10'
$ annie graph path shared-runtime-sa checkout-api
$ annie graph blast shared-runtime-sa
$ annie graph tree checkout-api
$ annie graph diagram checkout-api --level context

Those five read-only commands turn “this role change looks shared” into a concrete impact review with structural evidence, affected runtime objects, service dependencies, cycles, and a diagram ready for the pull request.

Next in the series: reconstruct a restart storm with Annie Graph. See the Annie CLI documentation for the complete graph command reference and the Graph Query Language reference for every query target and filter.