{"slug":"canonical/adr/ADR-2026-09-04-10-capability-governance-hermes-separation","title":"ADR-2026-09-04-10 — Capability, Governance and Hermes remain separated","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-04-10-capability-governance-hermes-separation.md","bytes":2361,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** ACCEPTED — 2026-09-04 (Founder Canon §18–20; Founder decision \"no monolithic AI Orchestrator\")\n\n## Context\n\nConvenient designs collapse \"decide what to do,\" \"decide what may be done,\" and \"get it done\"\ninto one orchestrator. That produces an autonomous actor with unreviewable authority — the\nexact failure the product must never have.\n\n## Decision\n\nThe responsibility split is frozen:\n\n```text\nTwin / Workbench      = what the user is trying to achieve\nCapability Discovery  = what executable options exist\nCapability Fabric     = how it could be done (provider-neutral resolution)\nGovernance            = whether it may be done and under whose authority\nHermes                = how approved execution is coordinated reliably\nReconciliation        = whether reality actually changed as intended\n```\n\n- Governance outcomes: **ALLOW · DENY · REQUIRE APPROVAL · DELEGATE / ALLOW WITH BOUNDED\n  AUTHORITY**. Confidence never grants authority; the Twin cannot self-approve consequential\n  action.\n- Delegation is explicit, capability-scoped policy (BOUNDED_DELEGATION) — never implied by\n  capability discovery.\n- Hermes starts only after a plan is approved or policy-allowed; it coordinates dispatch, waits,\n  retries, timeouts, recovery/compensation, evidence capture, verification and reconciliation —\n  and never owns canonical truth.\n- Execution providers may include APIs, MCP tools, agents, browser runtimes, workflows, local\n  execution, AI models or human tasks. No product surface, agent, connector or capability\n  implementation bypasses the owner of canonical composition, authority or mutation.\n\n## Alternatives considered\n\n- A monolithic AI orchestrator combining cognition + authority + execution — rejected:\n  unreviewable authority, unbounded blast radius, vendor lock-in of the operating model.\n- Governance as a workflow step after execution — rejected: it is a cross-cutting boundary\n  evaluated before any consequential action.\n\n## Consequences\n\nEvery capability declares version, contracts, authority scope, risk, execution/sync modes,\nidempotency, evidence requirements, provider routes, health, timeout, retry, compensation and\nverification behavior before it is executable. Middleware and gateways must not create implicit\napprovals.\n"}