{"slug":"canonical/adr/ADR-2026-09-04-08-ai-bounded-operational-sandbox","title":"ADR-2026-09-04-08 — AI operates in a bounded Operational Sandbox","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-04-08-ai-bounded-operational-sandbox.md","bytes":2285,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** ACCEPTED — 2026-09-04 (Founder Canon §5.2/§9/§26; constitutional memory rule)\n\n## Context\n\nAI participants that read or write canonical truth directly — or that inherit a host's or\nprovider's authority — collapse the boundary between inference and organizational truth, and\ncreate unauditable mutation paths.\n\n## Decision\n\n- **AI never directly reads or writes canonical Spine.** AI operates in a bounded **Operational\n  Sandbox**: working context derived from the Spine for a user, role, task and interaction.\n- AI receives **Context Packages** — bounded, policy-filtered, expiring, provenance-carrying —\n  never unrestricted organizational memory. The **Active Context Bundle** states its own\n  completeness level (host-local / partial / canonical) and names missing systems.\n- **Spine Cache is the default agent read surface** (read-optimized, policy-filtered,\n  LLM-readable, always rebuildable). **Fortress Spine is never directly exposed** to hosts or\n  agents.\n- **Constitutional memory rule:** `User thought ≠ AI inference ≠ Organizational truth`. AI\n  Continuity Memory stays AI working continuity; promotion to organizational memory is an\n  explicit Triage/Governance/governed-write transition.\n- Every agent carries identity, tenant, purpose, owner, delegated authority, scopes, capability\n  access, memory namespace, model profile, risk policy and audit identity. MCP tools never\n  receive direct storage credentials; ACP and MCP are transports, never authority grants.\n- Models are replaceable reasoning providers selected by stable profiles; no model version is\n  part of the durable contract.\n\n## Alternatives considered\n\n- Give agents direct DB read paths for speed — rejected: bypasses policy filtering, provenance\n  and audit; unbounded context leaks.\n- Let promoted AI output skip review when confidence is high — rejected: confidence never grants\n  authority.\n\n## Consequences\n\nEvery agent read path must traverse a policy-filtered surface; every AI-originated canonical\ncandidate is staged with origin, confidence and approval lineage (register G-19/G-20 track the\nobject model; the Flow-C boundary in the memory promoter enforces the never-auto-approve rule).\n"}