Mission Control Product Principles

Target architecture — not the current operating contract

This page preserves product direction. For available behavior and procedures, see the current release.

These principles define boundaries that every product module and runtime must preserve. Canonical terminology is defined in the glossary.

Control kernel first

Identity, registry, lifecycle, policy, approvals, evidence, observability, evaluation, and platform configuration are shared capabilities owned by the Control Kernel. Optional modules consume versioned kernel contracts and do not implement private copies of these semantics.

The kernel controls and records the estate. It does not execute agent business logic, perform model inference, invoke MCP tools, render a published application, or replace an enterprise source system.

Existing and native agents are peers

Agents built outside Mission Control use the stable Agent identity, environment-scoped grants, policy, Agent keys, Runs/Traces, evidence envelope, and operational views. Agents built in a future Agent Studio can use managed authoring, releases, and the optional native runtime. Managed release resources are not required for an external Run.

Native authoring is a paved road, not a governance shortcut. External origin is not a second-class status when the runtime satisfies the same contract.

Governed means enforced

A run is governed only when every model call passes through the Model Gateway and every MCP tool call passes through the Connector Gateway. A runtime may not call a provider or MCP server directly, and gateway failure never permits a direct-call fallback.

The gateways resolve identity and immutable versions, request policy decisions, pause for durable approvals, enforce access and operating controls, propagate trace context, and publish evidence. Telemetry observed after execution cannot retroactively make a bypassed run governed.

MCP is the integration boundary

MCP is the only enterprise integration protocol. Mission Control registers MCP servers, discovers their typed tools, and exposes each tool internally as a connector with its own identity, owner, version, risk posture, grants, and exactly one primary classification: Data, Decision, or Action.

Classification is per tool, never per server. Data and Decision connectors are side-effect-free from the caller's perspective. A tool that changes enterprise state, emits an externally meaningful event, or initiates side-effecting work is an Action connector. Composite behavior belongs in a workflow composed from multiple connectors.

Models are not connectors. Providers and model deployments remain behind the separate Model Gateway and Model Management product area.

Customer-resident by default

The first reference deployment is single-tenant inside the customer's AWS account and private network boundary. Customer SSO is authoritative for human identity, customer secret management retains provider and MCP credentials, and workload identities use short-lived environment-scoped credentials.

OpenAI-compatible model access, MCP, OpenTelemetry, external policy evaluation, stable Agent/Run identity, and customer-owned evidence export preserve portability. Equal Azure, GCP, SaaS, and on-premise operations are deferred until the AWS reference is stable.

Metadata first, content by exception

Every governed path captures the identifiers, versions, decisions, timing, usage, cost, status, and outcome references needed to operate and reconstruct it. Bounded permitted trace content follows the stored capture policy; hidden reasoning and hard-excluded credentials/files are never retained.

Content capture requires a named purpose and explicit redaction, access, retention, deletion, export, and legal-hold controls. Business references and citations are preferred to unrestricted payload copies.

Evidence is customer-owned

Mission Control writes structured evidence inside the customer boundary and makes it available through controlled exports. Evidence connects goals, actors, resource versions, policy, approvals, model and connector use, actions, evaluations, incidents, and outcomes.

Evidence is append-only. A correction or changed interpretation creates a new attributed event linked to the earlier record; it never rewrites history. Mission Control neither requests nor stores hidden model chain-of-thought. Explanations consist of explicit inputs, policy reasons, declared outputs, trace events, and outcome evidence.

Current governance mapping

The current source release uses Organizations, Teams, real user/service-account virtual keys and separate human management roles. Agent is managed application content; deployments own secretless execution access and publisher funding. Observe uses Requests, Traces, Sessions and Usage with separate metadata/content/export permissions. Historical identity terms in this target proposal are not the operating contract. See Current release.