◇ GOVERNANCE_BY_CONSTRUCTION

Identity is derived at every hop — never read from the request body.

Venus derives the caller from the token; child agents act on-behalf of the real principal through a session mint issued by the security plane. 'On whose behalf' travels as a signed token, not as a field someone can declare.

Authorization is executable, closed-world policy (OpenFGA): no explicit grant, no access.

Access is a relation in an authorization model, not a convention in a prompt. Capability grants are per tenant, checked on each sensitive call, and the check is auditable after the fact.

Tamper-evident audit trail — what, who, under what authority, over which data.

Audit records are hash-chained in the Moon, written under a per-tenant write-time lock, with write scope restricted. Chaining gives evidence of tampering without the cost of distributed consensus.

Tenant, quota and budget scoped per principal (Saturn).

Tenants are first-class: principals, roles, capability plans, quota and budget live behind one owner, and reads resolve the tenant from the token rather than trusting a query parameter.

Model and agent are pluggable — harness-agnostic via MCP.

Inference routes through a single gateway across external providers and local models. The governance contract holds identically for Claude Code, Codex and Cursor: the method and the graph are the asset, not the vendor.

Every task declares its cost before running.

No runaway processes, no surprise bills. Every execution has a pre-declared budget for time, resources, and operations. If the budget is exceeded, the task is safely terminated.