Canonadr

ADR-2026-09-04-08 — AI operates in a bounded Operational Sandbox

Status: ACCEPTED — 2026-09-04 (Founder Canon §5.2/§9/§26; constitutional memory rule)

Context

AI participants that read or write canonical truth directly — or that inherit a host's or
provider's authority — collapse the boundary between inference and organizational truth, and
create unauditable mutation paths.

Decision

  • AI never directly reads or writes canonical Spine. AI operates in a bounded Operational
    Sandbox    : working context derived from the Spine for a user, role, task and interaction.
  • AI receives Context Packages — bounded, policy-filtered, expiring, provenance-carrying —
    never unrestricted organizational memory. The Active Context Bundle states its own
    completeness level (host-local / partial / canonical) and names missing systems.
  • Spine Cache is the default agent read surface (read-optimized, policy-filtered,
    LLM-readable, always rebuildable). Fortress Spine is never directly exposed to hosts or
    agents.
  • Constitutional memory rule: User thought ≠ AI inference ≠ Organizational truth. AI
    Continuity Memory stays AI working continuity; promotion to organizational memory is an
    explicit Triage/Governance/governed-write transition.
  • Every agent carries identity, tenant, purpose, owner, delegated authority, scopes, capability
    access, memory namespace, model profile, risk policy and audit identity. MCP tools never
    receive direct storage credentials; ACP and MCP are transports, never authority grants.
  • Models are replaceable reasoning providers selected by stable profiles; no model version is
    part of the durable contract.

Alternatives considered

  • Give agents direct DB read paths for speed — rejected: bypasses policy filtering, provenance
    and audit; unbounded context leaks.
  • Let promoted AI output skip review when confidence is high — rejected: confidence never grants
    authority.

Consequences

Every agent read path must traverse a policy-filtered surface; every AI-originated canonical
candidate is staged with origin, confidence and approval lineage (register G-19/G-20 track the
object model; the Flow-C boundary in the memory promoter enforces the never-auto-approve rule).