Resource and Evidence Model

Target architecture — not the current operating contract

This page includes future resource and evidence types. For retained data in the current gateways, see Current security behavior.

The current release has no first-class Run. It records one decision per gateway request (inference_decision) and stores the gateway's request spans with any exported runtime spans in the span store under caller-owned W3C Trace identity. Optional namespace-scoped Session identity groups Team activity without becoming authority or a lifecycle resource.

Mission Control uses one resource identity and one evidence envelope across the Control Kernel, modules, gateways, runtimes, and Operations and Assurance. Domain-specific records may extend these contracts but cannot redefine identity, policy, lineage, or retention semantics.

Shared resource fields

Every first-class resource carries:

• A globally stable identifier and resource type.
• Display name and description.
• Customer and environment scope.
• Business owner, technical owner, and operational contacts where applicable.
• Lifecycle state and the immutable version reference used for publication or execution.
• Risk tier, data classification, and connector classification where applicable.
• Capability grants, access rules, and policy bindings.
• Creation, modification, review, approval, promotion, suspension, rollback, and retirement attribution.
• Links to activity, runs, traces, evidence, evaluations, outcomes, and incidents.

References use identifiers rather than display names. Names may change; identity and historical links do not.

First-class resource types

The shared registry includes:

• Agents, Agent Teams, grants, keys/workload identities, Runs, and optional managed releases.
• Workflows and AI Applications.
• MCP Servers and Connectors.
• retrieval sources and Retrieval Collections.
• model providers, model deployments, and Virtual Models.
• policies, policy bundles, and approval routes.
• evaluation suites and versioned evaluation datasets.
• environments and other versioned platform configurations when they participate in authority or evidence.

Target runtime instances such as Runs, Traces, policy decisions, Governance Approvals, Human Tasks, incidents, evidence exports, and outcomes reference stable resource identity and any applicable managed versions. Current external execution is attributed to the Organization, Team, virtual key and its owner, and the W3C Trace; external code registers no Agent identity, and observed runtime versions are optional telemetry.

Version and lifecycle rules

A mutable draft receives a new immutable version when it is submitted for review. Review, approval, promotion, activation, suspension, rollback, and retirement append attributed lifecycle events.

• Published versions never change in place.
• An active environment binding points to one approved version for new work.
• An execution pins the versions it resolved at its declared boundary; it does not silently adopt later edits.
• A rollback activates an earlier approved version and records a new event.
• Historical Runs continue to resolve the exact configuration, policy, model route, and Connector version they used.

The shared lifecycle is described in the Control Kernel contract.

Shared event envelope

Every control change and execution event includes the applicable fields from this envelope:

Field group	Required semantics
Event identity	Event identifier, event type, schema version, timestamp, producer, and integrity metadata
Scope	Customer and environment identifiers
Principal	Human or workload principal, acting role or grant, and delegated principal when present
Resource	Resource identity, resource type, and immutable version
Correlation	Request, Run, Trace, parent span, and business correlation identifiers
Capability	Requested operation, target identity and version, and Connector class where applicable
Authority	Policy bundle and version, decision, reason, matched rule references, and Governance Approval reference
Execution	Status, attempt, timing, typed failure, usage, estimated cost, and resolved runtime, deployment, or Connector version
Business context	Stable references to business objects and citations rather than unrestricted payload copies
Result	Outcome, evaluation, correction, and incident references when available
Information governance	Content-capture purpose, redaction state, retention class, deletion state, access class, and legal-hold marker

Events are additive. A component can attach a typed payload governed by its own schema, but it cannot replace the envelope's identity, authority, lineage, or information-governance fields.

Evidence semantics

Evidence is append-only and customer-owned. It records explicit system facts: declared goals and inputs, identities, versions, grants, policy inputs and results, approvals and rationales, model and Connector calls, execution status, selected outputs, evaluations, incidents, corrections, and outcomes.

Corrections are new attributed Evidence Events that identify the superseded interpretation or erroneous fact and explain the correction. The original event remains addressable, so exports and Run reconstruction can show both history and current interpretation.

Mission Control does not request or store hidden model chain-of-thought. Model explanations are limited to declared outputs, explicit citations, tool and trace activity, recorded policy reasons, evaluation results, and other intentional evidence.

Content capture

Operational metadata is captured for every governed path. Prompt, response, tool, document, and business payload content is captured only for an approved purpose.

Any content-capture rule declares:

• Purpose and permitted consumers.
• Data class and source authority.
• Redaction or tokenization behavior.
• Access and environment restrictions.
• Retention, deletion, export, and legal-hold behavior.
• Whether the content may appear in telemetry, durable evidence, a Retrieval index, or a controlled export.

Run evidence prefers business-object references, hashes, schema-safe summaries, and citations over raw content duplication.

Storage boundaries

Logical store	Contents	Boundary rule
Operational store	Registry, configuration, versions, ownership, permissions, policies, approvals, lifecycle, and current environment bindings	System of record for Mission Control control state; not for unrestricted execution payloads
Telemetry store	Traces, metrics, logs, usage, performance, health, and cost	Operationally optimized, retention-bounded, and linked to durable evidence where required
Evidence store	Durable decisions, provenance, audit events, evaluation artifacts, corrections, exports, and selectively retained governed payloads	Append-only product history with controlled access and export
Retrieval index	Approved derived content, chunks, embeddings, citations, ACL metadata, deletion markers, and freshness state	Derived from authoritative sources and removable according to source-linked policy
Customer secret manager	Provider, MCP server, signing, and service credentials	Customer remains the credential authority; Mission Control stores references and brokers scoped access

Physical technologies may consolidate these logical stores initially. Their access controls, retention, encryption, ownership, and failure semantics remain distinct product contracts.

Reconstruction contract

A Run Explorer or evidence export must be able to traverse from a Run to its initiating principal and trigger, Agent/environment/key identity, applicable managed resource versions, policy decisions, approvals, model routes, Connector calls, Workflow steps, application interactions, costs, evaluations, incidents, corrections, and outcomes. Missing optional runtime-version or content telemetry must not prevent reconstruction of the control path.

Current governance mapping

The current source release uses Organizations, Teams, real user/service-account virtual keys and separate human management roles. Agent is managed application content; deployments own secretless execution access and publisher funding. Observe uses Requests, Traces, Sessions and Usage with separate metadata/content/export permissions. Historical identity terms in this target proposal are not the operating contract. See Current release.