System design

How the architecture holds its boundary

A production system is defined by what it refuses as much as what it accepts. Authorize the exact action, keep credentials out of the model context, and leave an evidence bundle another system can verify offline.

Control planes

Agent Passport

A signed passport binds agent, device, delegation claims, mailbox, and latest audit anchor.

Mandate and consent plane

Short-lived mandates state action, resource, budget, expiry, and whether human consent is required.

Provenance Ledger

Hash-linked events, signed bundles, manifests, anchors, and trust bundles preserve provenance.

Request lifecycle

enrol agent and device
  → issue scoped mandate or credential
  → authorize tool or outbound action
  → pause for consent when required
  → append signed evidence
  → verify offline or export

Failure model

Unknown keys, expired mandates, invalid signatures, cross-tenant identifiers, and unauthorised tools fail closed before a protected action.

Verification checklist

Scoped authority: Every credential and mandate is least-privilege, expiring, and tenant-scoped.
Server-side secrets: Provider credentials are injected server-side and never placed in prompts or browser storage.
Fail-closed verification: Compliance callbacks and evidence verification reject missing, stale, or invalid signatures.
Portable evidence: Evidence, retention, verification, auditor access, and open-format export are never usage-metered.

← Back to overview