Reference workflow · browser-local draft

No connector runs, no customer data loads, and the draft is not saved to a project or executable. Download a JSON design snapshot for review.

Designed contract ≠ runtime record

Assurance flightplan

Identity posture → assessment package

Browser draft

Registry definitions: 6
Typed roles: 26
Specialization modules: 125

Audit objective planner Agent reference console

Object library

Build from contracts

3 live collectors36 declared, never counted as collected

Drag into the canvas or press an object to add it. Keyboard users can reorder from the inspector.

Designed graph

Compose the governed path

Draft changed

Lens

Human on the loop · does not block

Oversight rail

AlertPolicy denial · scope drift · budget breachPause authority

Private reasoning contract

Private assurance reasoning planeDesign contract · no model connected

Reference inference routePrivate boundaryPlanned · setup requiredFixture onlyLocal · no model call

Model identity: Required at deploy
Evaluation admission: Required · fail closed

Restricted evidence policyNo external-model egressLocked

typed handoffscope inherited
evaluatescope inherited
interruptpolicy narrows
approved statehuman delegates
assemblescope inherited

Run-bound provenance

Assurance passport contract

Source + schemaBind at collection
Route + modelIdentity required
Evaluation gateAdmit or refuse
Human decisionJudgment retained
Release receiptSign after approval

Preview contractUnsigned · no run existsA receipt is created only from an executed, human-released version.

Typed handoffObservationHuman authorityFail closed

Preflight record

Validate before a version can be considered for deployment

Version identity requiredTyped contractsAuthority splitNo-egress policyModel identity required

Not executed

Assurance inspector

Challenge evidence quality

Agent task02 / 06

Purpose

Test freshness, population completeness, source identity, and placeholder evidence before assessment.

Output contract

evidence.quality.findings/v2

Runtime standing

Configured in this reference · inactive

Memory scope

Run-scoped · no cross-tenant memory

Typed input bindingBound source id · okta-mfa-policy · schema · identity.policy.snapshot/v1

Deployment preflight

6 unique, stable node identitiesLocal check
6 typed node outputsLocal check
Every agent has a compatible, upstream typed source bindingLocal check
At least one typed evidence inputLocal check
At least one bounded agent taskLocal check
At least one fail-closed policy gateLocal check
At least one blocking human decisionLocal check
Every blocking decision has an authorized participant bindingLocal check
At least one governed output artifactLocal check
The terminal node is a governed artifactLocal check
1 non-blocking observer stationLocal check
Restricted evidence external egress disabledLocal check
External submission disabledLocal check
Tenant resource grantsRequired at deploy
Immutable published workflow versionRequired at deploy
Private endpoint and exact model identityRequired at deploy
Adapter and training-dataset digestsRequired at deploy
Current model evaluation scorecardRequired at deploy
Durable signing identity for release receiptRequired at deploy

Production authoring still requires tenant-scoped immutable versions, membership-backed participant ids, and a publish receipt.

Contract plane

Typed data, tasks, handoffs, and artifactsMCP-compatible adapters · source identity · schema checks

Authority plane

Identity, policy, approvals, and interventionLeast privilege · human gates · observer override

Durability plane

Checkpoint, resume, replay, and compensateImmutable version · append-only trace · recovery path