Features
Everything in one model, and nothing you have to take on trust.
This page is for the architect who has to live in the tool. It is depth, not persuasion. The last section lists what is missing.
33 building-block types, across 6 layers
Business, Application, Technology, Portfolio, Platform and Regulatory. Every type is a real object with its own attributes, its own relationships and its own list, detail and history views. The platform layer is first-class: clusters, namespaces, workloads, datastores, network endpoints and certificates are objects you model, not free text on a technology record.
Relationships and business mapping
Relationships are navigable in both directions. A business mapping ties a system release to the process, function, unit and product it serves, so “who is affected” is a query, not an interview.
Custom attributes
Six attribute types, including time series, scoped per building-block type, with full administrative control over the catalogue.
Limit, stated here: custom attribute values are not full-text searchable and are not included in the list export.
35 checks, recomputed on every request
Orphaned objects, lifecycle date inversions, incomplete releases, missing business context, resilience gaps, security gaps and network exposure. Nothing is stored between runs, so there is no “last scanned” date to mistrust and no stale report to explain. The count on the screen is produced by the engine itself — a test fails the build if the number and the engine ever disagree.
Limit, stated here: you cannot yet mark a finding as accepted risk. Suppression is not built.
Five views, drawn by the server
Landscape layer map, lifecycle roadmap, impact and blast radius, TIME scatter, and neighbourhood. All five are rendered server-side and arrive as finished pictures, which is precisely why they work offline and under a strict content security policy. Pan, zoom and click through to the object.
Limits, stated here: diagrams are generated from the model and read-only — there is no free-form drawing canvas. SVG, PNG and PDF download exist for the landscape and roadmap views; the other three are on-screen and click-through only.
NoveamQL — ask the model a question
A path-based query language over the metamodel, read-only by grammar: the syntax has no mutation at all, and the planner emits parameterised SELECT statements against a read-only database handle. Save a query and it stores its source text, recompiled on every run, so a change to the metamodel can never leave a stale execution plan behind.
The metamodel itself is published as a stable JSON contract at GET /query/schema — every type, every edge, every operator. If you can express it, you can pull it.
Find it, and see what changed
Full-text search is write-through: every create, update and delete re-indexes immediately, so results never lag the model. Change history is field-level — an actual list of what changed from what to what, per object, with the person resolved.
Limits, stated here: history is per object. There is no global activity feed and no history export, and it is not a security audit log.
In by upload, out by contract
Discovery is push. You export from the source and upload it; Noveam reconciles. Three formats are read today: Kubernetes object lists, kube-bench results and SQL Server catalogue exports. Re-uploading is idempotent — objects are matched by external identity, your manual edits win over imported values, and any field that diverges is recorded as drift for review instead of being silently overwritten.
Out: CSV, JSON and XLSX for lists, plus OSCAL component-definition JSON for the control catalogue.
Limits, stated here: there is no live discovery agent. The list export carries three columns — identifier, name and last-updated. There is no spreadsheet import.
The honest trade. A live agent needs credentials into the estate it inventories. In the environments Noveam is built for, that is frequently the thing that stalls a procurement for a quarter. Upload is what a change-controlled or air-gapped environment can actually approve.
Not built
Verbatim, no hedging.
- Mass update and bulk edit
- Report builder and scheduled reports
- Configurable dashboards
- Free-form diagramming
- Per-object permissions
- SCIM provisioning
- Spreadsheet import
- A product interface in any language other than English