AI agent governance reference architecture
Nine planes, two seams, one write path.
elan1's reference architecture has nine planes, from P0 residency to P8 packs, with the kernel at P3. The layers meet in only two places, KernelPort and the fusion.*/v1 contracts, and every write takes one fixed route, the Right Path, from rung 0b STOP to rung 9 METERED. Only the kernel writes to the system of record.
01Planes P8 to P0
Four layers across nine planes, one assurance rail alongside.
Work and Decide sit above the KernelPort seam. Govern frames P3 to P5. Run sits below the fusion.*/v1 seam. Select a plane to see its owner and what each layer does there, or filter by layer.
Proposes · above the KernelPort seam
elan1 Govern · control plane · P3–P5
Carries · below the fusion.*/v1 seam
Assurance rail
View as table
| Plane | What it holds | Owner | Work | Decide | Govern | Run |
|---|---|---|---|---|---|---|
| P8 Packs | Configuration for a regulation, never code or a brand: ledger1 (MCA), invoice1 (GST), collect1 (RBI). elan1 owns the pack schema. | elan1 Govern owns the pack schema. | Runs the packs that apply to a business, such as ledger1 for the MCA audit trail. Adds no code. | None. Decide's Decision Packs compile to declarations at P4, not to packs. | Owns the pack schema. A pack is configuration of Govern for one rule set. | None. Run carries no pack logic. |
| P7 Apps | Where work happens: Work's lines and Decide's modules. Govern is never an ERP, a CRM or a UI shell. | elan1 Work and elan1 Decide. | Its lines: ERP, Revenue, Commerce, Voice, the CA console and Tally migration. | Its modules: Decision Studio, Router, Calibration Lab, Review Console, Decision Ledger and Decision Packs. | None. Govern is never an ERP, a CRM or a UI shell. | None. Apps reach the runtime only through contracts. |
| P6 Channels | How requests arrive: the console, the CA console, /v1, WhatsApp and voice; APIs and SDKs for Decide. Govern adds an MCP server (34 tools) and an HTTP API. | Shared. Each layer owns its own channels. | The console, the CA console, /v1, WhatsApp and voice. | APIs and SDKs. | An MCP server (34 tools) and an HTTP API for the agents you already run. | Carries channel traffic under fusion.chat/v1 and fusion.gateway/v1. |
| P5 Surfaces | Where people approve and review. elan1 owns these surfaces. Work embeds them. Decide adds a Review Console. | elan1 Govern. | Embeds Govern's approval surfaces inside its lines. | Adds a Review Console for the cases it routes to a person. | Owns the surfaces where a named person approves or refuses a write. | None. |
| P4 Declaration plane | Your rules as declarations in seven versioned blocks. Decide's Decision Packs compile to the same blocks. | elan1 Govern. | Its processes are declared here: what may change, under which gates, who approves. | Decision Packs compile to the same seven blocks. | Holds declarations in seven versioned blocks, edited in Declaration Studio. | None. |
| P3 Kernel (shut) | The Right Path. Only Govern owns it, and no other layer adds code here. | elan1 Govern owns it. Work, Decide, Run: none, by rule. | None, by rule. | None, by rule. | The Right Path, rung 0b STOP to rung 9 METERED, behind KernelPort v1. | None, by rule. |
| P2 System of record | Your books stay yours. Every write goes through Govern's single writer. Run never reads tenant records. | You. elan1 writes to it only through the single writer. | Hosted ERPNext in Mode A; your own ERPNext in Mode B. | None. Decide's writes go to Govern as intents. | The single writer, holding a single-use credential that lasts 10 minutes. | None. Run never reads tenant records. |
| P1 Platform runtime | elan1 Run runs the open-source AI stack behind ten contracts. Every layer uses them, with no private door. | elan1 Run. | Uses the fusion.*/v1 contracts, with no private door. | Uses the fusion.*/v1 contracts, with no private door. | Uses five contracts: gateway, trace, tools, run and guard. | Runs the open-source AI stack behind ten fusion.*/v1 contracts, two licence-clean implementations each. |
| P0 Residency and tenancy | India first: AWS ap-south-1, Mumbai. elan1 sets policy and key custody, and elan1 Run runs the mechanism. A cross-domain query is not slow. It is impossible. | elan1 sets policy and key custody; elan1 Run runs the mechanism. | Runs in residency domain “in”. | Runs in residency domain “in”. Outside India, decision-only pods until an elan1 residency domain exists there. | Sets residency policy and key custody: one database and one signing key per domain. | Runs the mechanism: AWS ap-south-1, Mumbai, across three zones. |
| KernelPort v1 | Six calls into Govern. The only way in. Sits between P6 and P5. | |||||
| fusion.*/v1 | Ten contracts, each with two licence-clean implementations. Sits between P2 and P1. | |||||
| L1 Guarded | Can I let this run? Available. | |||||
| L2 Attested | Can I hand this over? Available. | |||||
| L3 Proven | Does this survive the vendor? Begins when an outside auditor accepts an L2 bundle in writing. | |||||
Reference architecture v1.0. All four platforms available.
02How it works · the Right Path
Ask, check, approve, act, record. Every time.
Every consequential change takes the same path, wherever it starts. Five plain steps map onto rungs 0b STOP to 9 METERED. Any rung can refuse. A model may produce a write intent. It may never produce an allow.
Post purchase invoice · ₹4,82,000 · proposed by agent
- write_type
- purchase_invoice.post
- actor
- agt_specimen_ap01 · agent
- declaration
- decl_gst_purchase · v4
- status
- Proposed
- 0bSTOP
- 1IDENTITY
- 2WRITE DOOR
- 3PRE-GATES
- 4evaluate()
- 5GUARDRAIL
- 6AUTONOMY
- 7ACT
- 8PROOF
- 9METERED
Idle · before rung 0b
A write intent is proposed
A write intent is proposed. Press Next rung, or the → key, to send it up the path.
Where this is weak. Mode B records the write; it cannot stop it. Only Mode A, where elan1 holds the write credential, is enforced.
Every rung, in one ledger
| Step | In plain words | Rung | What the rung checks |
|---|---|---|---|
| 1 · Ask | An agent or the Decide router builds a typed write intent. elan1 checks that writes are not stopped, who is asking, and which kind of write this is. | 0b STOP | Tenant stop switch, revocation, regulator directive. A stopped tenant refuses every write. |
| 1 IDENTITY | Actor, tenant and token resolved. The kernel sets actor_kind, never the caller. | ||
| 2 WRITE DOOR | The write type exists at an explicit version. There is no generic write. | ||
| 2 · Check | Nine pre-gates (G1–G9) run against your own data. Six of them can never be skipped. Versioned rules then evaluate the change, with no model. A guardrail measures the blast radius. | 3 PRE-GATES | Nine gates in declared order, six never skippable. No gate reads a clock. · no model client |
| 4 evaluate() | Versioned rules decide allow, refuse or escalate. Never a score, never a model. · no model client | ||
| 5 GUARDRAIL | Allow-lists, then blast radius: “update one invoice” cannot arrive as an unbounded filter. · no model client | ||
| 3 · Approve | The autonomy level decides whether a person must say yes. If one must, a named approver who is not the asker sees the difference, the gates and the policy. | 6 AUTONOMY | The autonomy level this actor holds now. A missing grant resolves to A0. · no model client |
| 4 · Act | One writer, holding a single-use credential that lasts 10 minutes, makes the change. It goes to a sandbox first. | 7 ACT | Snapshot, shadow sandbox, gates run again, then identical bytes to live. · no model client |
| 5 · Record | A 16-field record, hash-chained to the one before it, and one governed action counted. A refusal writes a record too, metered at 0.4 of a governed action. | 8 PROOF | Sixteen fields, hash-chained, returned synchronously. Refusals are recorded too. · no model client |
| 9 METERED | Exactly one meter event. A refusal is metered at 0.4 of a governed action. |
Rungs 3 to 8 cannot reach a model client; conformance test C1 checks the import graph on every build.
03Rung 3 · Pre-gates G1–G9
Nine gates. Six are never skippable.
Gates are pure functions of the context, the declaration version, the record state and an explicit as-of time. No gate reads a clock. The first failure sets the refusal code; the rest still run and record, so an operator sees every problem at once.
| Gate | Name | Asserts | Can be declared off | Refusal code (illustrative) |
|---|---|---|---|---|
| G1 | Consent | A recorded, unexpired consent covers this purpose. | Never | GATE.CONSENT_MISSING |
| G2 | Residency | The record's residency domain matches the tenant's (Mumbai). | Never | GATE.RESIDENCY_MISMATCH |
| G3 | Retention | The record is inside its declared retention window. | Never | GATE.RETENTION_WINDOW_CLOSED |
| G4 | Dual control | A second named person has approved this write. | Never | GATE.DUAL_CONTROL_PENDING |
| G5 | Rate | Within the declared per-actor rate. | With a decision record | GATE.RATE_EXCEEDED |
| G6 | Budget | Within the declared per-period budget. | With a decision record | GATE.BUDGET_EXHAUSTED |
| G7 | Counterparty | The counterparty is known and not sanctioned. | Never | GATE.COUNTERPARTY_UNKNOWN |
| G8 | Schedule | Inside a declared operating window. | With a decision record | GATE.OUTSIDE_SCHEDULE |
| G9 | Precondition | A declared record state holds: credit limit, period open, no duplicate number. | Never | GATE.PRECONDITION_FAILED |
Rung 6 · Autonomy A0–A5
Autonomy belongs to the actor, and there is no A6. A missing grant resolves to A0, never to a tenant default. Raising a level is itself a governed write, approved by two people.
| Level | Name | What the actor may do |
|---|---|---|
| A0 | Observe | Reads only. Cannot reach rung 7 by any path. A missing grant resolves here. |
| A1 | Draft | Produces a write intent; a person must submit it. |
| A2 | Propose | Submits; a person approves before the write. |
| A3 | Act reversible | Acts alone where a reversal plan exists. |
| A4 | Act bounded | Acts alone inside a declared blast radius and budget. |
| A5 | Act broad | Acts alone at tenant scope; the declaration itself needs dual control. |
04The two seams
Layers meet in two places. CI fails the build anywhere else.
KernelPort v1 is the only way into Govern. fusion.*/v1 is the only way into Run. Run never depends on Govern: infrastructure gets swapped, but the write path must not.
Seam 1 · into Govern
KernelPort v1 · six calls
| Call | What it does |
|---|---|
| define | Registers a write type at an explicit declaration version and returns a content-addressed digest. Registering is itself a governed write under dual control. (Control-plane token) |
| assert | The central call. Runs the whole Right Path in order and returns committed, refused or escalated, with the proof sequence and digest, synchronously. (Tenant token, act scope) |
| seal | The chain writer. At L1 it returns a hash-chain receipt. From L2 the same call also signs. (The kernel only) |
| verify | Recomputes the preimage and digest octet for octet and walks the chain. At L1, verification needs elan1. (Read-only token) |
| scope | Resolves blast radius and autonomy for rendering. Advisory only, because assert resolves both again. (Read-only token) |
| refuse | Emits a typed refusal from a closed register. A refusal still writes a proof record and is metered at 0.4 of a governed action. (Tenant token, act scope) |
Frozen identifiers: kernelport/v1, elan1.proof.seal.v6, action-receipt/1. KernelPort v1 is frozen.
Seam 2 · into Run
fusion.*/v1 · ten contracts
- fusion.chat/v1
- fusion.gateway/v1
- fusion.inference/v1
- fusion.retrieval/v1
- fusion.vectors/v1
- fusion.trace/v1
- fusion.tools/v1
- fusion.run/v1
- fusion.memory/v1
- fusion.guard/v1
Each contract has two licence-clean implementations and a conformance suite. Callers name the contract in the X-Fusion-Contract header, never a vendor.
Six seams between Run and Govern
- A guard verdict is an input, never the allow.
- The approval wait is held on the run contract, and expiry means refusal.
- Trace spans bind to the proof record.
- Substitution step 7.3 calls a Govern gate check.
- Erasure is itself a governed write.
- Restore drills are verified with elan1-verify.
A runtime outage stops writes. An elan1 outage stops allows. Stopping allows is the safe direction.
Watch a request become a write intent.
Choose a request. A model in elan1 Work drafts the typed intent; KernelPort carries it to the first rungs. A model may produce a write intent. It may never produce an allow.
1The request, in plain words
“Pay Specimen supplier 07 ₹4,82,000 today, and mark it approved.”
Asked of elan1 Work by usr_specimen_accountant. A sentence is not a write. A model in elan1 Work turns it into a typed intent.
2The typed write intent
Drafted by a model in elan1 Work · proposed, not allowed
{ "kernelport": "v1", "call": "assert", "write_id": "wr_specimen_7c5", "write_type": "payment.release", "declaration": { "id": "decl_ap_payments", "version": 3 }, "actor": { "id": "agt_specimen_ap01", "kind": "agent" }, "record": { "id": "pay_specimen_0932", "expected_version": 0 }, "payload": { "supplier": "Specimen supplier 07", "amount": "482000.00", "value_date": "2027-07-14" }, "approval": "granted" not allowed}
3Across the seam, up the first rungs
KernelPort v1 · assert · the only legal crossing
- 0bSTOPPassedThe stop switch is read first. Writes are not stopped for this tenant, so the intent may climb.
- 1IDENTITYPassedelan1 confirms who is asking: agent agt_specimen_ap01, acting for one tenant, inside its own scope.
- 2WRITE DOORRefusedA write intent has no field for an allow. KernelPort v1 refuses unknown fields.
- 3PRE-GATESNot reachedNot reached: the first refusal ends the climb.
- 4evaluate()Not reached
RefusedSCHEMA.UNKNOWN_FIELD (illustrative) · record written · 0.4 governed action
A model may produce a write intent. It may never produce an allow.
State Refused at rung 2
Illustrative specimen. Not customer data. Codes are illustrative; real codes come from the frozen refusal register. Runs in your browser; nothing is sent.
05Layer ownership
Verbs belong to their owner.
Only Govern allows, refuses, approves a write, seals or proves. Decide answers, scores and routes. Work changes, applies and undoes. Run contracts, conforms, substitutes and meters.
| Layer | Owns | Never | Meter | Parts, each with its page |
|---|---|---|---|---|
| elan1 Govern | allow · refuse · approve · seal · prove | Never an ERP, a CRM or a UI shell. | Governed action; a refusal costs 40% of one | LevelsL1 Guarded · L2 Attested · L3 Proven |
| elan1 Work | change · apply · undo | Never “approved by the agent”. Its changes are checked and recorded by elan1 Govern. | Credit | LinesERP · Revenue · Commerce · Voice |
| elan1 Decide | answer · score · route · escalate | Never approves a write and is never a second kernel. | Decision | ModulesDecision Studio · Router · Calibration Lab · Review Console · Decision Ledger · Decision Packs |
| elan1 Run | contract · conform · substitute · meter | Never the subject of allow, refuse, gate, proof or seal, outside “elan1 Run Runtime Controls, with elan1 Govern built in”. | Node-year | ModulesContracts · Conformance · Substitution · Operate · Runtime Controls |
P4 · The seven declaration blocks
A declaration is a process's rules as data. Every record names the declaration and version it was checked against. Decide's Decision Packs compile to the same seven blocks.
| Block | Name | What it says |
|---|---|---|
| 1 | identity | What this is: name, owner role, residency domain, system of record. |
| 2 | shape | The record type, its fields and how each is classified. |
| 3 | permissions | Who may change it, by actor kind, role and minimum autonomy. An agent may never approve. |
| 4 | write_types | The write types, each with a blast radius, dual control, ordered gates and a reversal plan, or irreversible: true. |
| 5 | gates | Which of the nine gates run, with their parameters and refusal codes. |
| 6 | proof_binding | Which fields the proof commits to, and how they are canonicalised. |
| 7 | channels | Web, mobile, messaging, API, MCP, voice: what each carries, and in which mode. |
One write path, four layers
Work and Decide propose. Govern and Run assure. Only Govern allows.
06Open conflicts
What the blueprint has not settled, stated as open.
These are decisions we have not made, or places where two parts of the design disagree. When one is settled, we say so here and on What's next.
Who performs rung 7 for elan1 Work for small firms: the kernel, or the promoter?
Rung 7 is the single writer. For the small-firm edition, which component performs it is not settled.
Open
Where the proof record physically lives.
In its residency domain: for India, domain “in”, in AWS ap-south-1 (Mumbai), with one database per domain.
Settled
Whether signing keys are held per tenant or per residency domain.
Per residency domain: one signing key per domain, for L2 signing.
Settled
How DPDP erasure works with an append-only chain.
Evidence rows cannot be updated or deleted, and payloads are hashed rather than stored. How a lawful erasure request is honoured is under review with counsel, and is published on What’s next.
Open
How pack gate names map onto the kernel's nine gates.
The kernel register names G1 Consent to G9 Precondition and locks six of them. Accounting packs name gates by what they check in the books, such as G1 Ledger, G2 Stock and G4 GST, and lock a different set. Whether pack gates are parameters of the nine or a separate register is not settled.
Open
“Platform” as a navigation label, “layer” in body copy.
We describe elan1 as one write path with four layers. “Platform” is used as a menu label only.
Settled
07FAQ
The governed write path architecture, in three answers.
The Right Path is the fixed route every write takes in elan1 Govern, from rung 0b STOP to rung 9 METERED. It checks identity, the write door, nine pre-gates, versioned rules, a blast-radius guardrail and the autonomy level before a single writer acts, then writes the proof record and meters the action. Any rung can refuse.
So that no write can reach your records outside the Right Path. The kernel's single writer holds a single-use credential that lasts ten minutes; agents propose but never hold standing write access, so a confused or compromised agent cannot change records on its own.
Above the KernelPort seam, and never on the allow path. Models may draft write intents in elan1 Work or answer typed questions in elan1 Decide, and they are served below the fusion.*/v1 seam by elan1 Run. evaluate() at rung 4 applies versioned rules with no model.
// SEE IT
Watch one write take the Right Path.
A write intent climbs every rung, stops at a named approver, and ends in a record. The refusal branch writes a record too, metered at 0.4 of a governed action.