ADR-0001: Control Kernel and Composable Modules

Target architecture — not the current operating contract

This accepted decision guides product direction. For available behavior and procedures, see the current release.

Status

Accepted — 2026-08-19

Context

Enterprise AI products often assemble agents, workflows, applications, integrations, policy, and operations as adjacent features with separate identity, lifecycle, permissions, approval, and evidence semantics. The result looks integrated in navigation but fragments control and creates duplicate platform services. Making every capability mandatory would avoid some fragmentation but would force customers to adopt authoring modules they do not need and would turn Mission Control into an undifferentiated suite.

Mission Control must support heterogeneous existing estates and an optional first-party paved road while preserving one definition of governed identity, authority, release, execution, and evidence.

Decision

The mandatory Control Kernel owns shared identity and access, resource registry, lifecycle and provenance, policy and authority, approvals and decisions, evidence and audit, observability and evaluation, and platform configuration.

Agent Studio, Automations, AI Applications, Retrieval, Connectors, Model Management, Policy Studio, and Operations experiences consume versioned kernel contracts. Authoring and delivery modules are composable where the approved product boundary permits; they do not create private copies of kernel semantics.

The kernel controls and records the estate. It does not execute Agent business logic, own Workflow or reasoning-session state, perform inference, invoke MCP tools, index enterprise content, render published applications, or replace customer systems of record.

Consequences

• Every resource and module shares one identity, owner, lifecycle, authority, Trace, evaluation, and evidence vocabulary.
• Customers can enable focused capabilities without fragmenting governance or being forced to rebuild existing Agents.
• Module teams depend on explicit kernel interfaces and cannot optimize locally by inventing alternate approval, lifecycle, or evidence models.
• The kernel is mandatory and must meet high availability, migration, security, and compatibility standards even when few optional modules are enabled.
• Early implementation may deploy the kernel and management experience as a modular application, but internal boundaries and independently deployable gateways and workers must be preserved.
• Future module proposals must identify their singular responsibility, kernel contracts, runtime ownership, connections, and non-goals before they add navigation or data models.

Current governance mapping

The current source release uses Organizations, Teams, real user/service-account virtual keys and separate human management roles. Agent is managed application content; deployments own secretless execution access and publisher funding. Observe uses Requests, Traces, Sessions and Usage with separate metadata/content/export permissions. Historical identity terms in this target proposal are not the operating contract. See Current release.