Skip to content

ADR-0003: Enforced Model and Connector Gateways

Target architecture — not the current operating contract

This accepted decision guides product direction. Use the current Gateway APIs for implemented behavior.

Status

Accepted — 2026-08-19

Context

Post-hoc logs can describe some provider and tool activity, but they cannot prove that identity, grants, policy, approval, version, budget, guardrail, idempotency, or evidence controls were applied before execution. Model inference and enterprise tool invocation also differ in protocol, credential, routing, risk, validation, retry, and cost behavior. Combining them into one generic gateway would blur these contracts; allowing runtimes to call providers or MCP servers directly during failure would make governance optional exactly when risk is highest.

Mission Control needs one enforceable path for each execution category across native and external runtimes.

Decision

Governed executions use two separate boundaries:

  • The Model Gateway is the exclusive OpenAI-compatible inference path. It owns provider and deployment resolution, Virtual Model routing, credential isolation, access, approved fallback, quota, budget, concurrency, guardrails, usage, cost, Trace, and evidence publication.
  • The Connector Gateway is the exclusive MCP tool path. It owns transport, server authentication brokering, tool and version resolution, typed validation, access, contextual policy, durable approval, idempotent resumption, invocation, result normalization, usage, Action, Outcome, Trace, and evidence publication.

Native runtimes, external runtimes, Workflow workers, indexing workers, application services, and browsers cannot bypass the applicable gateway. Gateway or control failure never permits direct-call fallback. Action Connectors fail closed when identity, policy, approval, version, idempotency, or evidence guarantees are unavailable.

Consequences

  • Governed status means preventive controls were enforced, not merely that telemetry was received later.
  • Models remain outside the MCP Connector Catalog, allowing each gateway to expose a protocol-appropriate contract and operating model.
  • Native and external Agents can share one enforceable identity, policy, cost, Trace, and evidence path.
  • Gateways become critical infrastructure and require independent deployment, scaling, health, typed failure, bounded retry, circuit-breaker, and evidence-outbox behavior.
  • Provider or MCP availability can reduce execution availability because controls fail closed; the product must present explicit degraded state, exceptions, and incidents rather than bypass.
  • Any future client, runtime, embed, batch, or recovery path must use gateway clients and propagate the shared identifiers and immutable resource versions.

Current governance mapping

The current source release uses Organizations, Teams, real user/service-account virtual keys and separate human management roles. Agent is managed application content; deployments own secretless execution access and publisher funding. Observe uses Requests, Traces, Sessions and Usage with separate metadata/content/export permissions. Historical identity terms in this target proposal are not the operating contract. See Current release.