Skip to content

ADR-0006: Native and External Agent Runtimes

Partially superseded by ADR-0007

ADR-0007 replaced this record's external manifest, release-version, and attestation requirements at the time. The native/external peer-governance boundary remains accepted; see the supersession notice below for the current Trace-native identity.

Partially superseded

ADR-0010 replaced the current external Run identity with Agent-attributed W3C Trace context and standard OTLP. The native/external peer-governance boundary remains accepted; other Run terminology below is historical target context.

Target architecture — not the current operating contract

Native runtime and deployment attestation are not included. See the Agent Studio status and current agent identity guide.

Status

Accepted — 2026-08-19

Context

Enterprises already operate Agents built with different frameworks, languages, deployment systems, and runtime patterns. Requiring every Agent to be rebuilt in a first-party Studio would slow adoption, discard working investments, and make Mission Control another isolated runtime. Treating external Agents as loosely observed resources, however, would create a lower-governance tier and make estate-wide policy, cost, evidence, and incident views unreliable.

Mission Control also needs a first-party paved road that can demonstrate safe session, delegation, gateway, Trace, evaluation, and release behavior without making native origin a privileged governance status.

Decision

Native and external Agents are peers under the same control and runtime contract.

The optional native runtime owns reasoning-session state, loops, delegation, checkpoints, limits, streaming, cancellation, suspension, resumption, gateway clients, OpenTelemetry, and shared Evidence Events. External runtimes can register through an SDK or declarative manifest and remain customer-deployed.

Both paths must use:

  • A stable Agent identity, owners, declared capabilities, policy bindings, and immutable definition and deployment versions.
  • A short-lived, environment-scoped workload identity and least-privilege grants.
  • The Model Gateway for every model request and the Connector Gateway for every MCP tool request.
  • Shared Request, Run, Trace, parent-span, resource-version, environment, and idempotency identifiers.
  • The shared evidence envelope for runtime facts not already emitted by gateways.
  • An immutable deployment attestation associated with each execution.

Automations owns durable Workflow state. An Agent runtime owns its reasoning-session state. A Workflow can invoke an Agent and an Agent can request a Workflow through typed registered boundaries, but the state machines do not merge.

Consequences

  • Customers can onboard existing Agents without rebuilding them and still see native and external Runs in the same Estate, Trace, policy, evaluation, cost, incident, and evidence views.
  • Agent Studio is a paved road and product differentiator, not a gate to governance or a shortcut around controls.
  • External runtimes must adopt gateway clients, workload identity, Trace propagation, Evidence Events, and deployment attestation; telemetry alone is insufficient.
  • An external Agent that bypasses a required gateway is explicitly ungoverned even when some activity is observable.
  • The native runtime cannot claim private policy, Connector, model, lifecycle, or evidence semantics.
  • Runtime framework differences can remain behind the shared contract, but conformance and end-to-end failure testing become release requirements.
  • Future orchestration features must preserve the separate ownership of probabilistic reasoning sessions and durable business-process state.

Current governance mapping

The current source release uses Organizations, Teams, real user/service-account virtual keys and separate human management roles. Agent is managed application content; deployments own secretless execution access and publisher funding. Observe uses Requests, Traces, Sessions and Usage with separate metadata/content/export permissions. Historical identity terms in this target proposal are not the operating contract. See Current release.