Control Profiles
The exact versioned requirements for core, personal/proactive, enterprise, durable/delegated and high-assurance workflows.
Profiles select explicit obligations for an admitted workflow. They are composable requirements, with current evidence needed for each control. They confer no certification, legal permission or universal production readiness. The immutable TypeScript STANDARD_PROFILE_REGISTRY defines the initial five profiles and twenty controls at exact revision "1"; Execution Contract defines admission and enforcement boundaries.
Exact profile definitions
Every stronger profile includes contextos.core@1. The high-assurance profile also includes the enterprise and durable/delegated profiles. Selecting multiple profiles requires their union; there is no fallback to the weakest selection.
| Profile ID, revision 1 | Mandatory additions | Deployment focus |
|---|---|---|
contextos.core | identity.authenticated, authority.scoped, policy.fail_visible, context.integrity, audit.correlated | Authenticated authority, deterministic visible failure and correlated evidence. |
contextos.personal-proactive | authority.revocation, approval.bound, isolation.required, credentials.brokered, data.flow_policy, budget.aggregate, operations.stop_recover | Owner/channel/device boundaries, bounded standing mandates and personal/work separation. |
contextos.enterprise | authority.revocation, approval.bound, isolation.required, credentials.brokered, data.flow_policy, budget.aggregate, release.pinned, governance.separation, operations.stop_recover | Tenant/principal lifecycle, protected administration, processor configuration and owned incident paths. |
contextos.durable-delegated | authority.revocation, approval.bound, isolation.required, effects.reconciled, execution.checkpointed, delegation.attenuated, budget.aggregate, operations.stop_recover | Child/task/operation identity, bounded fan-out, cancellation and fenced recovery. |
contextos.high-assurance | Includes core, enterprise and durable/delegated; adds assurance.fault_evidence. | Independent administration, authorized fault testing and a scoped assurance argument. |
These are exact definitions, not marketing tiers. For example, durable/delegated requires demonstrated delegation support even when a current run uses one worker. Selecting a different profile is an explicit admission decision; silently omitting a requirement is not a downgrade mechanism.
Common feature conditions
All five profiles apply the following conditions in addition to their mandatory sets. The admission adapter derives the booleans from the actual workflow and runtime. Required unknown state rejects; a model declaration is not a trusted feature manifest.
| Enabled feature | Additional required controls, revision 1 |
|---|---|
external_network | network.mediated |
persistent_memory | memory.lifecycle |
external_effects | effects.reconciled, approval.bound |
delegation | delegation.attenuated, budget.aggregate |
checkpoint_resume | execution.checkpointed |
arbitrary_code | isolation.required |
sensitive_data | data.flow_policy |
proactive_triggers | authority.revocation, approval.bound, budget.aggregate, operations.stop_recover |
An explicitly optional control cannot demote any requirement from these tables. Support is exact by ID and revision. A schema-valid but unsupported revision rejects negotiation. Unknown required controls, conflicting definitions, cycles and excess expansion reject instead of truncating.
Control evidence registry
Every control definition carries evidence obligations and registered useful/denied case IDs. Initial case IDs use <control_id>.useful and <control_id>.denied; the deterministic test suite does not claim all those runtime cases have been demonstrated. A deployment suite must execute the applicable cases against its actual workflow and dependencies. The conformance assessor requires the registered positive and negative cases, verified current evidence and required utility cases.
| Control | Required behavior and evidence | Owner / blocking failure |
|---|---|---|
identity.authenticated | Verified principal/workload, tenant, audience and trust-domain binding. | Identity broker; spoofed or mismatched identity blocks. |
authority.scoped | Purpose, capability/revision, resources, arguments, destination, amount and delegation intersection. | Mandate broker/gateway; scope expansion blocks. |
authority.revocation | Bounded-freshness current revocation observations. | Authority broker; unknown/unavailable/stale observations block protected work. |
policy.fail_visible | Explicit policy composition and structured failure for applicable evaluation errors. | Policy engine/admin; errors cannot become an allow or a silently false predicate. |
approval.bound | Exact stored proposal/action/request, expiry, entitlement, quorum and atomic redemption. | Approval service/store; substitution or expired requests block. |
context.integrity | Pinned provenance, verified bytes and untrusted-data/instruction separation. | Compiler/admission; untrusted content cannot create privileged authority. |
isolation.required | Current active boundary matching actual code/tools and trust domains. | Execution broker/sandbox; missing/failed controls block without fallback. |
credentials.brokered | Scoped short-lived credentials outside model-visible state and actual issuance/revocation enforcement. | Credential broker; missing mediation blocks credentialed work. |
network.mediated | Destination, DNS and redirect controls at real egress, independent of business policy. | Egress enforcer; prohibited destinations block. |
data.flow_policy | Actual purpose, source labels, recipients, processors/residency and approved transformations at every stage. | Data-policy/processor adapters; prohibited or unknown flow blocks. |
memory.lifecycle | Owned namespace, provenance, reviewed promotion, retention and correction/deletion propagation evidence. | Memory owner/service; incomplete propagation stays visible. |
effects.reconciled | Stable operations, provider-specific retry evidence and honest partial/unknown outcomes. | Durable controller/provider adapter; blind retry blocks. |
execution.checkpointed | Pinned artifacts, current authority/approval/budget and owned fenced resume. | Checkpoint/controller store; stale executor or changed interpretation blocks. |
delegation.attenuated | Child identity, ancestor intersection/revocation, bounded outputs and cancellation propagation. | Parent controller/authority broker; child scope expansion blocks. |
budget.aggregate | Shared root/child/retry/replan capacity, exact units, reservations, verified settlement and inherited deadline. | Atomic ledger/metering adapter; exhaustion blocks, unknown usage retains capacity. |
audit.correlated | Run/trace/operation/decision/control correlation, minimization, access control and retention. | Audit owner; absent evidence prevents the corresponding assurance claim. |
release.pinned | Evaluated artifact set, extension admission, protected changes and rollback limits. | Release owner; release drift requires impact review/reevaluation. |
operations.stop_recover | Owned stop/escalation/reconciliation queues and observed dependency-outage/recovery behavior. | Operations owner; unresolved failures remain blocked or escalated. |
governance.separation | Independent required approval/control roles and protected policy/release administration. | Governance owner; self-authorized lowering of protected requirements blocks. |
assurance.fault_evidence | Authorized fault/abuse tests, observed recovery and workflow/release/environment-specific assurance argument. | Independent assessor/operations; absent evidence prevents high-assurance conformance. |
Personal and proactive agents
A standing mandate names its owner, authenticated trigger channel/device, purpose/tasks, capabilities, resources, destinations, budget, lifetime, escalation path and revocation. Trigger text and contacts’ messages remain untrusted input. At every wake and dispatch, check the trigger’s provenance and current authority, approval, budget and boundary. Notification delivery is not consent; a casual message cannot silently expand a mandate.
approval.bound permits useful standing-grant workflows when policy requires no per-action click. When policy does require approval, exact stored binding and validity are mandatory. Owners need inspection of scheduled/in-flight work, pause of future triggers, grant revocation, stop requests and visible confirmed/uncertain effect state. Sharing a machine does not merge personal, family or employer trust domains. Memory, credentials and readers remain separately scoped.
Offline/edge deployments declare trustworthy time, observation age, bounded local authority and reconnect reconciliation. Protected work suspends once required revocation freshness cannot be established. Reconnection does not authorize blind replay of queued effects.
Workflow applicability and remaining domain obligations
| Workflow | Profile/feature starting point | Additional assurance needed |
|---|---|---|
| Personal calendar, inbox or household assistant | Personal/proactive; actual network, memory and external-effect features. | Channel/device authenticity, owner controls, shared-person boundaries, credential scope and notification policy. |
| Enterprise support, procurement or back office | Enterprise; external effects, sensitive data and any durable/delegated features. | Tenant lifecycle, approver entitlements, actual processor/residency routes, retention and protected administration. |
| Coding, research or analyst workers | Durable/delegated; arbitrary code, network, checkpoint and memory as used. | Sandbox/egress enforcement, extension provenance, aggregate fan-out and stale-worker recovery. |
| Financial, clinical or legal assistance | Appropriate enterprise/high-assurance composition plus actual enabled features. | Applicable domain law/standards, expert accountability, allowed effect boundaries and independently reviewed safety case. |
| Industrial, physical-control or critical infrastructure workflow | High assurance where appropriate; exact declared effect/availability requirements. | Independent interlocks, physical safety engineering, authorized operational drills and explicit human stop authority. |
| Edge/offline operations | Selected functional profile with bounded offline authority. | Trusted time, revocation windows, isolated storage, reconnect deduplication and operational failure behavior. |
No general profile proves every use case safe. Specify allowed effects, failure/threat model, dependencies, escalation owner, stop authority, recovery objectives and accepted limitations for each workflow. Record observed recovery time and data loss for tested failures rather than inventing one universal RTO/RPO.
Versioning and adoption
Registry, profile and control refs bind immutable payloads with distinct canonical hash domains; each definition excludes its own reference when hashed. Adding a mandatory requirement creates a new revision. Migration pins both interpretations, reviews compatibility and reevaluates affected workflow evidence. A changed policy, tool, model, extension or boundary configuration needs impact review; unpinnable provider models remain explicit limitations.
Use Execution Contract to connect the requirements to your runtime, and Conformance to distinguish declared support, reference checks and demonstrated deployment behavior. Public availability of these requirements does not change the repository’s all-rights-reserved license or supply certification.