Gold Standard · Intelligence specialist guide
Find the nearest question, then follow the evidence
A network picture is useful only when every node and line has a defined identity, source, time window and meaning—and when missing data remain visible instead of becoming invisible assumptions.
Link analysis helps a reader see relationships that are difficult to hold in prose: which entities are connected, through what relationship, at what time, on whose evidence and with what uncertainty. It can reveal duplicated identities, repeated intermediaries, isolated components or a bridge whose position deserves closer examination.
The same visual power can mislead. A thick line may reflect more records rather than a stronger relationship. A central node may be a data-collection artefact. Missing links may be unobserved, impossible or deliberately absent. This guide treats the network as an auditable evidence model, not a picture that convicts, diagnoses or authorises action.
Choose a reading route
Define the graph
Question, entities, edges and time.ROUTE 2 · CHAPTERS 4–5
Control evidence
Identity resolution and source dependence.ROUTE 3 · CHAPTERS 6–7
Work the network
Build a fictional association map.ROUTE 4 · CHAPTERS 8–10
Test structure
Centrality, brokerage, communities and gaps.ROUTE 5 · CHAPTERS 11–12
Transfer and audit
Changed context, governance and reproducibility.
Open the full chapter index · Use the field check · Return to the Intelligence root
Chapter contents
Chapters 1–3 · Question, entities and relationships
Chapters 4–6 · Evidence, identity and reconstruction
Chapters 7–9 · Measures, brokerage and missingness
Chapters 10–12 · Transfer, governance and audit
CHAPTER 1 OF 12 · Define the graph
1. Start with an intelligence question and graph boundary
A graph should answer a defined analytic question. The same records can support an ego network around one entity, a whole-network map of a bounded population or a temporal network that changes across intervals. Without a boundary, the analyst confuses the collected database with the world.
State the focal question, entity types, relationship types, geography, time window, inclusion rule and analytic cutoff. Decide whether the graph is directed, weighted, signed or multiplex and explain why. Keep an exclusion log for records outside scope and a collection-gap register for entities that may exist but are not observed.
A fictional student club studies how project information moved during one event. The network includes named roles and documented communications within a two-week window. It does not claim to represent every friendship or informal conversation.
Changed-context transfer check
Transfer the boundary to a supplier network. Choose whether purchase orders, shared directors, addresses and communications belong in one graph or separate relationship layers.
Limit and misconception
A sharply bounded graph can miss an important external actor. A broad graph can manufacture apparent relevance. Boundaries must be challenged and versioned.
Evidence practice
Keep the question, boundary, inclusion rules, excluded records and analytic cutoff. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: treating the available database as a complete network or expanding scope after seeing a preferred result. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
A node represents an entity under a declared identity rule: person, organisation, account, device, place, document, event or another type. Similar labels do not prove identity, and one real entity may appear under several records. Entity definition determines every later measure.
Create an entity dictionary with type, identifiers, temporal validity and resolution status. Keep raw records separate from resolved entities. Record merges, splits, aliases and contested matches with evidence and reviewer. Use type-specific symbols only after the underlying identity has been checked.
Two fictional accounts share the display name “Alex Tan” but have different verified identifiers and active periods. Merging them creates a false bridge between two groups. The analyst keeps them separate until corroborating evidence supports a match.
Changed-context transfer check
Apply the method to two companies sharing an address. Explain what the address proves, what it suggests and what evidence would support common control.
Limit and misconception
Entity resolution is probabilistic and context-sensitive. A unique-looking attribute can be reused, mistyped or stale.
Evidence practice
Keep the raw-to-entity map, evidence for merges and splits, confidence and review history. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: merging entities on name alone or treating a shared attribute as proof of identity. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 3 OF 12 · Define the graph
3. Define relationships, direction, weight and time
An edge is a typed assertion between entities, not a generic sign that they are connected. Communication, ownership, co-presence, payment, supervision and citation carry different meanings. Direction and time can be essential, and weight needs a unit rather than a thicker line.
For each relationship type, define source and target, qualifying event, start and end, weight unit, negative or contradictory evidence and aggregation rule. Preserve multiple observations separately when they come from dependent sources. Use layers when relationship meanings should not be collapsed.
Five messages from A to B and one purchase from B to A are not six units of one relationship. They belong to different layers with different direction and interpretation.
| Graph field | Question | Example restraint |
|---|---|---|
| Node | What entity and identity rule? | Record is not yet a resolved person |
| Edge | Which relationship is asserted? | Co-location is not communication |
| Weight | What counted unit? | Messages are not influence |
| Time | When was the relation valid? | Historical link is not current |
Changed-context transfer check
Change the case to an undirected co-attendance network. State the event window and why co-attendance does not establish communication or agreement.
Limit and misconception
Higher frequency is not automatically stronger influence, trust or importance. Weight describes only the defined measurement.
Evidence practice
Keep the relationship dictionary, direction, time, unit, source and aggregation rule. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: drawing one unlabeled line for every association and reading visual thickness as importance. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 4 OF 12 · Control evidence
4. Resolve identities without erasing uncertainty
Link analysis can amplify small identity mistakes because one mistaken merge may connect components and change centrality. Resolution should preserve alternatives and the evidence behind each decision rather than presenting a cleaned graph as unquestioned truth.
Use deterministic identifiers where reliable and probabilistic matching only with declared features, thresholds and review. Maintain possible-match links separately from confirmed identity. Run sensitivity with disputed merges accepted, rejected and unresolved to see which conclusions depend on them.
A shared telephone number joins two fictional business records, but the number belongs to a reception service. Treating it as a unique personal identifier creates a false broker. The sensitivity view shows that the brokerage claim disappears when the match is removed.
Changed-context transfer check
Transfer the test to a dataset with transliterated names. Design review rules that preserve spelling variants without forcing a single identity.
Limit and misconception
A confidence score does not become ground truth. Historical data, reused identifiers and unequal data quality can bias resolution.
Evidence practice
Keep candidate matches, features, thresholds, reviewer decisions and graph-level sensitivity. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: hiding uncertain matches inside a single resolved ID or tuning thresholds to create a connected graph. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
Multiple records may repeat one originating report, while highly monitored entities accumulate more links than equally active but less observed entities. Network density and centrality therefore reflect collection as well as behaviour.
Attach source, source-of-source, collection method, access date and reliability notes to each edge assertion. Build a provenance graph or dependency table so repeated reporting is not counted as independent corroboration. Compare observation opportunity across groups and time periods.
Three reports describe the same meeting, but two quote the first. The chart displays one underlying assertion with three reporting records rather than three independent meetings.
Changed-context transfer check
Change the case to platform logs available for one team but not another. Explain how the asymmetry affects degree comparisons.
Limit and misconception
Perfect correction for unknown missingness is impossible. Analysts should bound claims and show which measures are most exposed to collection bias.
Evidence practice
Keep edge-level source lineage, independence assessment and coverage comparison. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: counting duplicated reports as separate links or interpreting surveillance intensity as network importance. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 6 OF 12 · Work the network
6. Worked example: reconstruct a fictional project handover
A fictional community event suffers a missed equipment handover. Records include schedules, messages, sign-out sheets and interviews. The question is how the handover instruction moved and where acknowledgement failed, not who should be blamed.
The analyst defines people and role accounts separately, resolves aliases, and creates directed message and responsibility edges within a three-day window. Source provenance prevents a later summary from duplicating the original message. Time slicing shows that the designated coordinator left before the final schedule change.
The network reveals a brokerage point: one volunteer relayed updates between two teams. It also shows a missing acknowledgement edge. The team interviews the relevant participants and discovers that a shared inbox was inaccessible, so the gap reflects system design rather than deliberate withholding.
| Stage | Question | Evidence |
|---|---|---|
| Scope | Which handover and period? | Bounded event and cutoff |
| Identity | Who or what do nodes represent? | Entity register and aliases |
| Relation | What does each edge mean? | Typed, timed source record |
| Explanation | What caused the gap? | Interviews, access logs and alternatives |
Changed-context transfer check
Change the case so the shared inbox log is unavailable. State which conclusions remain supported and which become hypotheses.
Limit and misconception
The example is fictional. Real investigations must follow applicable law, privacy, due process and authorised access; a link chart is not proof of misconduct.
Evidence practice
Keep the bounded graph, raw-to-entity map, edge sources, time slices and corrected explanation. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: using the visual broker position to assign fault before checking role, access and missing evidence. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 7 OF 12 · Test structure
7. Use centrality as a question, not a ranking of importance
Degree, closeness, betweenness and eigenvector-like measures answer different structural questions. Degree counts adjacent ties; betweenness concerns paths; closeness depends on distance and reachability; recursive measures reward connection to connected nodes. None is a universal measure of influence.
Select a measure only after stating the mechanism and graph assumptions. Test directed, weighted and disconnected cases correctly. Compare rankings across plausible boundary, identity and missing-edge variants and retain raw values with uncertainty rather than publishing one league table.
A logistics account has high degree because every shipment creates a routine edge. A volunteer has modest degree but high betweenness between teams. Neither pattern proves authority; each suggests a different follow-up question.
Changed-context transfer check
Change the network by adding one unobserved bridge. Recalculate which centrality claims remain stable.
Limit and misconception
Centrality can reward data availability, role design or platform architecture. It does not measure guilt, competence, popularity or causal influence without additional evidence.
Evidence practice
Keep the chosen measure, mechanism, graph assumptions and sensitivity across plausible variants. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: calling the top-ranked node the most important person without defining importance. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 8 OF 12 · Test structure
8. Examine brokerage and structural holes with context
A broker sits between otherwise weakly connected groups and may facilitate translation, coordination or control. Brokerage is a structural opportunity, not a motive or moral judgement. The same position can create resilience or a single point of failure.
Identify candidate bridges using betweenness, cut sets or local constraint, then examine relationship type, direction, substitutability and actual role. Remove the node or edge in simulation and measure fragmentation, but verify the result against operational evidence and alternative routes.
The fictional volunteer connects planning and logistics groups. Removing the node splits the message network, yet a formal escalation route exists on paper. The real weakness is that the route was not usable during the event.
Changed-context transfer check
Transfer the analysis to a knowledge network where a broker translates between disciplines. Distinguish beneficial coordination from bottleneck risk.
Limit and misconception
Brokerage measures depend heavily on boundary and missing edges. A supposed sole bridge may disappear when an uncollected channel is added.
Evidence practice
Keep broker candidates, removal tests, role evidence, substitutes and uncertainty. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: equating brokerage with wrongdoing or assuming shortest paths describe actual information flow. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
Community-detection algorithms group nodes with relatively dense internal connection under a chosen objective. Different algorithms, resolutions and random seeds can produce different partitions. A cluster is a mathematical pattern that needs substantive interpretation.
Run more than one reasonable method, document parameters and test stability across time and missing-edge scenarios. Compare partitions with known organisational or functional boundaries without forcing agreement. Preserve overlapping membership when the domain allows it.
One algorithm splits the project network by work team while another isolates a dense shared-service core. Both patterns can be useful for different questions; neither proves secret coordination.
| Pattern | Useful question | Misreading to avoid |
|---|---|---|
| High degree | Which nodes have many recorded ties? | Most influential |
| Betweenness | Which nodes lie on many modeled paths? | Sole real-world intermediary |
| Bridge | Which link joins components or groups? | Proof of control |
| Cluster | Which nodes are densely grouped under this method? | Verified organisation |
Changed-context transfer check
Apply the method to a citation network where subjects overlap. Explain why a hard partition may misrepresent interdisciplinary work.
Limit and misconception
Modularity and similar scores can favour certain scales and miss small groups. Labels applied after clustering can smuggle in unsupported narratives.
Evidence practice
Keep algorithms, parameters, seeds, stability results and evidence supporting any labels. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: naming clusters as real-world groups solely from visual proximity or one algorithm. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 10 OF 12 · Transfer and audit
10. Analyse missing links without filling them by intuition
A missing edge can mean no relationship, an unobserved relationship, a relationship outside the time window, a source-access gap or a modelling choice. Link prediction ranks plausible unobserved edges from patterns; it does not discover facts by itself.
Classify missingness mechanisms, observation opportunities and censored sources. Use prediction only to prioritise lawful collection or validation. Evaluate against held-out known edges and compare simple baselines. Keep predicted, disputed and observed edges visually and analytically separate.
Two teams share several neighbours, so a common-neighbour score suggests a possible link. The analyst marks it as a collection lead, then finds no authorised record supporting direct communication. The edge remains absent rather than being promoted from probability to fact.
Changed-context transfer check
Transfer the method to incomplete historical correspondence where destruction is uneven. Explain why silence may follow archive survival rather than social distance.
Limit and misconception
High predictive accuracy on recorded data can reproduce collection bias. False positives can be harmful in people-centred contexts.
Evidence practice
Keep missingness classification, model, baseline, validation set and disposition of each predicted edge. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: drawing predicted links as observed facts or interpreting absence of evidence as evidence of absence. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 11 OF 12 · Transfer and audit
11. Transfer link analysis with privacy and proportionality
Networks can expose relationships about people who never consented to be mapped and can infer sensitive attributes from neighbours. The analytical purpose, legal basis, data minimisation and access controls must be settled before collection expands.
Conduct a necessity and proportionality review, minimise entity attributes, separate identifiers from analytic views and restrict sensitive edge types. Provide correction and challenge routes where appropriate. Set retention and deletion rules and prevent exploratory findings from becoming unreviewed operational labels.
A school maps voluntary project communication to improve handovers. It excludes private friendship data, publishes the purpose, lets participants correct records and deletes the graph after the improvement review.
Changed-context transfer check
Move the method to a public-health coordination network. Identify which aggregate insights can be retained without exposing individual relationships.
Limit and misconception
De-identification is difficult in distinctive graphs. Removing names does not automatically remove re-identification risk.
Evidence practice
Keep purpose, legal basis, minimisation, access, retention, correction and risk assessment. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: collecting more relationship data because the graph looks incomplete or treating pseudonyms as anonymity. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Next chapter
CHAPTER 12 OF 12 · Transfer and audit
12. Audit the network from raw record to claim
A reproducible link-analysis claim needs raw-source references, entity-resolution history, edge definitions, transformations, time filters, algorithms, parameters and narrative wording. The audit should reproduce both the pattern and the restraint attached to it.
Version the canonical node and edge tables, transformation code and visual configuration. Test impossible edges, duplicate sources, temporal leakage and boundary changes. Require claim review that distinguishes observed relation, inferred identity, structural measure and explanatory hypothesis.
The fictional handover analysis is rerun after an alias correction. The apparent sole broker becomes one of two bridges. The report is updated with a versioned correction rather than leaving the earlier chart unqualified.
Changed-context transfer check
Design a handover packet that lets a second analyst rebuild one chart and every measure without access to unnecessary private content.
Limit and misconception
A perfectly reproducible graph can still be irrelevant, biased or unlawfully assembled. Auditability supports correction; it does not replace legitimacy.
Evidence practice
Keep source register, versioned tables, code, parameters, outputs, claim review and correction history. Label every field as observed, computed, assumed or chosen. Give the record to a second reader and ask them to reproduce the result without the original author explaining what was meant. Differences reveal hidden definitions, missing versions or decision rules that still need to be made explicit.
Deliberately test for this failure: keeping only a screenshot while identities, filters and algorithms cannot be reconstructed. Record the earliest point at which the process can detect it, the correction applied and whether later conclusions change. A method is transferable only when its controls work on an altered case, not merely on the example used to teach it.
Contents · Previous chapter · Connected articles
Advanced boundary cases
Multiplex and heterogeneous networks
People, organisations, devices and events may require different node and edge types. Preserve the heterogeneous model or justified projections rather than flattening every relation into one adjacency matrix.
Temporal networks and event sequences
Aggregating across time can create paths that never existed simultaneously. Use time-respecting paths and intervals when order matters, and connect the analysis to the dedicated timeline guide.
Hypergraphs and group events
A meeting or shared document can connect many entities through one event. Pairwise projection may create many apparent direct ties; retain the event or hyperedge when that distinction matters.
A practical field check
Use this check before presenting a link chart, ranking a node or proposing a missing relationship.
- State the question, boundary, time window and graph type.
- Define entity types and preserve raw-to-resolved identity evidence.
- Define every edge, direction, weight and time rule.
- Trace source dependence and collection opportunity.
- Reproduce the graph from a canonical edge table.
- Select measures for a stated mechanism and run sensitivity.
- Keep observed, disputed and predicted links separate.
- Review privacy, proportionality, claim wording and corrections.
Run the check as a small workbook
Use separate sheets for raw records, entities, resolution decisions, edge assertions, sources, transformations, measures and claims. Every chart element should trace back to a row and every analytic row should retain its source and time.
| Gate | Pass condition | Stop condition |
|---|---|---|
| Boundary | Population, relation and time are explicit | Database mistaken for the world |
| Identity | Merges and splits are evidenced | Name-only resolution |
| Edge | Meaning, source and unit are defined | Unlabelled association |
| Claim | Measure and wording match evidence | Centrality or prediction presented as fact |
Chapter-by-chapter evidence audit
| Chapter | Evidence to keep | Failure to catch |
|---|---|---|
| 1. Start with an intelligence question and graph boundary | The question, boundary, inclusion rules, excluded records and analytic cutoff | Treating the available database as a complete network or expanding scope after seeing a preferred result |
| 2. Define entities before drawing nodes | The raw-to-entity map, evidence for merges and splits, confidence and review history | Merging entities on name alone or treating a shared attribute as proof of identity |
| 3. Define relationships, direction, weight and time | The relationship dictionary, direction, time, unit, source and aggregation rule | Drawing one unlabeled line for every association and reading visual thickness as importance |
| 4. Resolve identities without erasing uncertainty | Candidate matches, features, thresholds, reviewer decisions and graph-level sensitivity | Hiding uncertain matches inside a single resolved ID or tuning thresholds to create a connected graph |
| 5. Trace source dependence and collection bias | Edge-level source lineage, independence assessment and coverage comparison | Counting duplicated reports as separate links or interpreting surveillance intensity as network importance |
| 6. Worked example: reconstruct a fictional project handover | The bounded graph, raw-to-entity map, edge sources, time slices and corrected explanation | Using the visual broker position to assign fault before checking role, access and missing evidence |
| 7. Use centrality as a question, not a ranking of importance | The chosen measure, mechanism, graph assumptions and sensitivity across plausible variants | Calling the top-ranked node the most important person without defining importance |
| 8. Examine brokerage and structural holes with context | Broker candidates, removal tests, role evidence, substitutes and uncertainty | Equating brokerage with wrongdoing or assuming shortest paths describe actual information flow |
| 9. Treat communities and clusters as hypotheses | Algorithms, parameters, seeds, stability results and evidence supporting any labels | Naming clusters as real-world groups solely from visual proximity or one algorithm |
| 10. Analyse missing links without filling them by intuition | Missingness classification, model, baseline, validation set and disposition of each predicted edge | Drawing predicted links as observed facts or interpreting absence of evidence as evidence of absence |
| 11. Transfer link analysis with privacy and proportionality | Purpose, legal basis, minimisation, access, retention, correction and risk assessment | Collecting more relationship data because the graph looks incomplete or treating pseudonyms as anonymity |
| 12. Audit the network from raw record to claim | Source register, versioned tables, code, parameters, outputs, claim review and correction history | Keeping only a screenshot while identities, filters and algorithms cannot be reconstructed |
Connected articles across the eduKate ecosystem
Start with the governing route
- The Gold Standard of Intelligence
- The Gold Standard of Education | Learning That Transfers into Life
- How X Works hub
Continue into verified specialist studies
- Collection Requirements, Source Validation and Analytic Gaps — connect network gaps to lawful, prioritised collection.
- Source Triangulation, Circular Reporting and Corroboration Networks — separate independent support from repeated reporting.
- Timeline Analysis, Event Sequencing, Evidence Gaps and Competing Explanations — add event time and time-respecting sequence to relationships.
- Competing Hypotheses, Diagnosticity and Evidence Matrices — test alternative explanations for a network pattern.
- Indicator Validation, Base Rates and Warning Thresholds — prevent a structural signal from becoming an untested warning.
Questions readers often ask
Does a line prove two entities coordinated?
No. It proves only the typed relationship supported by the cited evidence, such as communication, co-attendance or payment.
Which centrality measure is best?
None universally. Choose the measure that matches the stated mechanism and test sensitivity to boundary and missing data.
Is a broker necessarily suspicious?
No. Brokerage can support translation and coordination or create a bottleneck; context and operational evidence determine meaning.
Can link prediction find hidden relationships?
It can rank patterns worth validating, but predicted links remain hypotheses until supported by evidence.
Why keep a canonical edge table?
It makes the graph, filters, measures and visual layout reproducible and separates evidence from presentation.
Is removing names enough for privacy?
No. Distinctive network structure can enable re-identification, so purpose, access, minimisation and retention controls remain necessary.
Sources and scope
United Nations Office on Drugs and Crime: Criminal Intelligence Manual for Analysts — official treatment of association matrices, link charts and analytic safeguards.
UNODC Intelligence Analysis course catalogue — official course descriptions for basic intelligence analysis and association matrices.
CIA Center for the Study of Intelligence: A Tradecraft Primer — official structured-analysis guidance on disciplined evidence and alternative explanations.
Linton Freeman: Centrality in Social Networks, Conceptual Clarification — foundational research distinguishing centrality concepts and measures.
Ronald Burt: Structural Holes and Good Ideas — research on brokerage as a structural mechanism, used here with explicit contextual limits.
All entities, communications and organisations in the worked examples are fictional. This guide supports lawful, proportionate analysis and does not authorise surveillance, attribution, disciplinary action or claims of misconduct.
“Gold standard” describes the educational benchmark explained in this guide. It is not an official accreditation, legal opinion, policy determination or professional certification.
Back to contents · Return to the Intelligence root · Return to the Gold Standard of Education