ManifestThe governed ontology layer

Action proposals — from any surface — become reviewed, audited mutations over a versioned object model.

🧭

One ontology, versioned

Object, action, and link types are authored in the designer, published as immutable versions, and served through a fail-closed registry — an invalid ontology never boots.

✅

Governed mutations

Every change is an action proposal that passes validation, guards, and — where the type demands it — human review before it touches an aggregate. One path mutates; everything else reads.

🛡️

Policy-decided access

Authlink's PDP arbitrates every read and write, with obligations — row filters, property masking rendered as explicit redaction, required reasons — enforced fail-closed at the platform seam.

🤖

Agent-native surface

MCP tools are generated from the registry itself — agents see exactly the types and actions policy lets them see, and dispatch through the same governed pipeline humans use.

📜

Event-sourced truth

Aggregates are Marten event streams; projections rebuild from them. History, audit, and drift detection come from the record of what actually happened.

🏭

Warehouse-aware

Object types bind to backing datasets with mapped reads, drift scanning, and governed write-back — the warehouse stays the system of record where it should be.