Architecture and safety

Layers

Manifests, resources, capabilities and events define the canonical contract. Protocol adapters project invocation; distribution profiles project discovery, experience and packaging. Business authority stays in the contracts and runtime.

Mutation path

Validate → Authorize → Policy → Approval when required
→ Idempotency → Connector → Transaction / Audit / Event

BusinessRuntime owns safety semantics. LLMs do not directly mutate business databases. Adapters cannot invoke Connectors to bypass authorization, policy or approval.

Identity and authorization

• Agent Identity is not Authorization: recognizing a caller does not grant unrestricted execution.
• Discovery is not Authorization: a Manifest describes capabilities, not mutation permission.
• Platform Identity supplies context and still requires business authorization.
• UI Confirmation is not an ApprovalRecord: a client confirmation does not replace trusted evidence.

Protocol and experience projections must preserve risk, approval, permissions, idempotency and audit semantics.

Core modules