The governance doctrine
Promotion, not deployment.
Agents are not pushed to production. They are promoted through a governed gate a human owns — so every capability in the mesh is one someone chose to stand behind. That is the difference between a demo and a system you can run a business on.
The gate is human.
Every agent release passes a human approval gate. Not a policy file, not a threshold — a named person who reviews the release and chooses to stand behind it. Accountability that can say no.
Decisions are on record.
Approvals and promotions are recorded and attributable. When an auditor asks who approved what, the answer should be a record, not a reconstruction.
The boundary belongs in the database.
Tenant isolation belongs in the database, not the UI. A boundary that lives in the interface is a suggestion; a boundary the data layer refuses to cross is a guarantee.
Production is one-way.
A one-way promotion from build to production, attributable and reversible. The principle: what was approved is what runs, and production is never edited in place. Rolling back means returning to the previous approved release, never editing the live one.
Capabilities are promoted too.
The same gate is meant to govern models. Cognition Factory, which is coming, is designed so that a cognition reaches the mesh only by passing the Model Breach — checksum, license, provenance, a real load probe. Cognitions are to be promoted, not shipped.
in design: one cognition → the gate → the mesh
Credit is governance.
We credit our tools by name — human, AI, and open source alike — because a company that hides how it works is a company asking you to trust it blind. How this was built →
For domain experts who are accountable for what their software does — build an agent your auditors would approve.