THE PLATFORM IN DEPTH

Everything that holds
the boundary.

Nineteen Rust services, two ways to execute work, the assistants that build on it, and the operations, evidence and authority around them — for the team that has to know how it works before it lets anything act.

Start free Talk to us

THE RUST SERVICE ARCHITECTURE

Modular by design.
Integrated by authority.

The Rust workspace is nineteen service directories over a set of shared domain crates. Each service ships as a single binary with no interpreter and no package tree to install beside it. This map describes code responsibilities, not live health or full parity with the wider platform.

The lifecycle of the work, the graph that orders it, and the worker that carries it forward.

LIFECYCLEa2a-execution-api

Execution

Goal, run, and task state; lifecycle transitions, dispatch, and cancellation routes.

Explicit execution state

ORCHESTRATIONa2a-workflow-engine-api

Workflow engine

Workflow runs and step transitions, approval-gated steps, compensation, and nested agent runs from a workflow step.

Compare-and-set step transitions

REASONINGa2a-agent-runtime

Agent runtime

Worker readiness, model-and-tool processing, bounded iterations, and recorded stop reasons.

Iteration and time budgets

OPERATIONSa2a-console-api

Console edge

Unified operator surface, session lifecycle, telemetry stream fan-out, and human-in-the-loop control plane.

Authenticated operator surface

THE OPERATING MODEL

Two ways to execute.
One governed platform.

Open-ended agent work needs room to reason. Repeatable business operations need a deterministic graph. A2A Matrix keeps those models structurally distinct with a single governed seam.

ADAPTIVE AGENT EXECUTION01

Let the agent reason.

A goal starts a run and a task. The agent iterates through context, model calls, and governed tool intents within its configured iteration and time budgets.

GoalAgent reasoning loopOutcome

Model-guided steps. Governed tool intents. Deadline-bounded.

DETERMINISTIC WORKFLOW DAG02

Define the workflow.

A workflow follows a predefined directed acyclic graph. An agent task step can spawn a nested agent run when an isolated phase of the process requires autonomous reasoning.

TriggerDeterministic DAGOutcome

Defined steps. Explicit dependencies. A bridge to open-ended agent work.

The Seam Invariant: A workflow’s agent_task step starts a nested runtime goal/run/task. A goal never becomes a workflow; run.workflow_id is provenance only.

BUILDING WITH THE PLATFORM

The platform is built
through its own front door.

Two assistants operate A2A Matrix from inside it: the foundry, which composes agents, workflows and configuration, and the copilot, which helps run the day. Neither is given a private path. Both call the interfaces an operator calls, with the operator’s authority and the platform’s ordinary evidence — policy evaluates their actions, approvals gate them, and the ledger records them exactly as it records a person’s.

FOUNDRY / COMPOSE

Composes, never modifies

The foundry assembles agents, workflows, connector assignments and policy through the platform’s own APIs and MCP tools — the same ones a person uses. It starts from a generated platform map and a route-authority snapshot rather than from tenant data, and it does not edit service code or reach into the database.

Map / Governed call / Recorded

FOUNDRY / BOUNDED

Narrows its own reach

A composer run is gated by its own permission and carries the operator’s authority, never more. Its token may name the modules it is allowed to touch, and that list only ever narrows — a run withholds the knowledge and artifact modules from itself, so tenant data cannot be pulled in through a tool or a passthrough.

Permission / Scope / Tool

COPILOT & WAR ROOMS

Helps run the day, and argues it out

The copilot answers from the live platform — runs, workflows, observability — through the same governed routes any caller uses, with voice input handled by a self-hosted transcription sidecar where one is configured. A war room is the other shape: several agents debating one decision in front of a person, streamed as it happens, each turn an ordinary metered completion under that person’s own credential. It is advisory by construction — nothing in the room executes anything.

Ask / Debate / Decide

ONE GOVERNED SURFACE

Both ask the same question

Every assistant here — the foundry, the copilot, and anything you connect over MCP — reaches the platform through one governed surface, and it answers only with what the person asking is permitted to do. Nothing that changes state runs without being planned first and shown for a real yes.

Ask in words / act within permission

OPERATIONS THAT RUN THEMSELVES

Nothing waits
on someone remembering.

Deadlines, stuck work, lapsed plans, ephemeral memory, storage retention and who gets told are not background jobs compiled into a service. Every cadence and threshold below is a row in the platform’s own policy tables: an unset value means the sweep does not run, and changing one is a configuration decision rather than a deployment.

GOVERNED CADENCEapproval_expiry_sweep_interval_ms

Approvals that expire

An approval past its deadline moves to expired, and the workflow step waiting on it fails with a named reason instead of waiting forever. Inside the governed reminder window, an approaching deadline raises one reminder — once per deadline, not once per sweep.

Deadlines are enforced, not remembered

GOVERNED THRESHOLDstale_run_incident_sweep_interval_ms

Work that stops is noticed

A run left planned or running past the governed threshold opens a single incident that names how long it has been stuck. A run that already has one is not read again, so the same stuck work cannot crowd out the next tenant’s.

One incident per stuck run

GOVERNED CADENCEentitlement_expiry_sweep_interval_ms

Entitlements that lapse

A lapsed plan enters whatever grace period it grants, then expires and suspends the tenant. The entitlement change, the suspension and the events recording both commit in one transaction, or none of them do.

Grace, then expiry, both recorded

GOVERNED ROUTINGnotification_rules

Notifications from the ledger

Events matching the configured rules reach a webhook signed with a shared secret. The body carries metadata only — never the event payload — and outside development a target that resolves inside the platform’s own network is refused rather than called.

Metadata leaves; payloads do not

GOVERNED RETENTIONmemory_expiry_sweep_interval_ms

Memory that expires

A memory entry or conversation context carrying an expiry date stops answering searches when its time is up. The sweep prunes the vector in Qdrant first and the database row second, so retrieval never returns phantom embeddings. An unreachable vector store leaves the row intact for the next pass.

Vectors prune first, rows follow

GOVERNED RETENTIONartifact_retention_sweep_interval_ms

Artifacts that age out

Generated files and run outputs past their configured document retention profile are purged from object storage. An active legal hold blocks the sweep exactly as it blocks an operator, storage bytes delete before rows update, and every removal records an immutable audit event.

Legal holds block; bytes delete first

CONTEXT THAT ARRIVES WITH IT

It already knows
what you call things.

The expensive half of an agent project is not the model — it is teaching a system your vocabulary, your measures and your rules. Ten industries arrive with theirs already written down, and every one of them stays editable.

INDUSTRY PACKScatalog.industry_packs

Ten packs, not a blank page

Accounting and tax, retail and corporate banking, mortgage lending, insurance operations, healthcare payer operations, legal services, civil engineering and construction, software development, stock trading and market research, and cinema development. A pack is a starting configuration rather than a sample: assigned to a company, it brings that industry’s vocabulary, its measures and its governance defaults with it instead of leaving a team to invent all three.

A configured start, not a demo

VOCABULARYa2a-catalog · terminology

It uses your words, not ours

A bank calls it a facility, an insurer calls the same record a policy, a law firm calls a project a matter file. Every label resolves company override → industry default → canonical → the key itself, and a region filters rather than ranks — adding an Indian label cannot change what a US reader sees. The same resolved labels assemble the agent’s prompt, so the assistant speaks in your nouns rather than the platform’s.

One vocabulary, console and agent alike

MEASUREScatalog.industry_kpi_maps

The measures your regulator names

Loan-to-value and debt-to-income, the full monthly PITI payment, loss ratio and combined ratio, asset classification by days past due, solvency under the local regulator. Each arrives as a definition, the formula it is computed by AND the rule it comes from — 12 CFR §1026.37(c) for a payment disclosure, the Homeowners Protection Act for a PMI threshold — so the figure an agent produces is one a reviewer can check rather than one they must believe.

A number with one definition

DRY RUNpack_application

See what it would change first

Applying a pack assigns it to a tenant, rewrites what the interface calls things, and installs policy defaults — three different ways to surprise somebody. The preview runs the same decision code as the real thing and writes nothing, so it previews the actual plan; and a policy default that fails validation rejects the whole application rather than leaving half of it applied.

Same decision, one flag apart

HOW YOU KNOW IT WORKS

Confidence is measured,
not asserted.

The question after “is it safe” is “is it any good, and will it stay that way”. Evaluation, assurance, backtesting and policy replay are ordinary surfaces here, with the tenant’s own history as the test set.

EVALUATIONa2a-intelligence-api · /eval

Scored against cases you keep

Datasets — the platform’s shared ones or your own — with thresholds that decide pass from fail. Deterministic scorers where an answer is checkable, a model judge where it is not, and a known-score check so the judge itself is measured rather than trusted. A prompt change is compared against the same cases before it becomes how the agent behaves.

A score against a threshold

ASSURANCE/assurance

Drift is somebody’s decision

Completed work is sampled and scored, and the assurance policy resolves from the platform’s to the company’s to the agent’s. When something degrades, what the platform produces is a proposal a named person decides — and the modes that would revert a release every tenant shares are refused rather than quietly enabled.

Nothing repairs itself in silence

BACKTEST/backtest

Prove a change on work already done

Build a case set out of runs that were already scored, run the candidate against it, and read the report before anything is promoted. The promote gate is the point: a change ships because it measured better on real history, not because it read better in a review.

Better on the record, then promoted

POLICY BACKTESTgovernance.policy_simulations

Rehearse a governance change

A candidate rule set is replayed against decisions the tenant has already made, so a rule that turns hundreds of allows into approvals is visible before it is published rather than in the support queue afterwards. The history that answers “is this change safe” was already on disk; this is what reads it.

Published knowing what it does

RETRIEVALknowledge · insight sources

What the agent actually knows

The collections, the files inside them and the state of every insight source, on one page. A retrieval layer that quietly stopped ingesting looks exactly like a model that got worse, and the two have completely different fixes — so the platform shows which one you are looking at.

Context you can inspect

REVIEW QUALITYreview rules · runs · results

The review process is measured too

Rules decide what gets a second look; runs record how those reviews went and what was repaired. An approval queue nobody audits becomes a rubber stamp within a quarter — this platform treats that as a measurable condition rather than a cultural complaint.

Rubber-stamping is visible

AUTHORITY, AND CHANGING IT

Your org chart,
and a Tuesday change.

Two questions every evaluation reaches: how does this map to the way we are organised, and what happens when a rule has to change next week. Both are answered by things you can point at rather than a services engagement.

ORG SHAPEa2a-identity-api

Authority follows your org chart

Departments, teams and memberships are the platform’s own model, and permissions resolve through them: a binding at company level applies everywhere, one at department level applies there and nowhere else. A question about one department cannot admit a binding from another — narrowing only, which is the rule that keeps a role from quietly meaning more than it was granted for.

Scope narrows, never widens

VISIBILITYcatalog scope rules

Not every team sees every agent

Catalog assets — agent profiles, connectors, workflows — are made visible and enabled per company or per department. A finance workflow is not a menu item for everyone who logs in, and an assignment is a record rather than a convention somebody remembers.

Visible where it belongs

APPROVAL CHAINSchain_selection

Who may approve, and how many

A chain decides which people may clear a request and at what quorum, replacing the requester’s own list — because a requester nominating their own approvers is not an approval. Separation of duties refuses their own vote, and a gate nobody can ever satisfy reports itself as unsatisfiable instead of looking like a colleague who has not replied.

The requester never clears it

RELEASESconfig.config_releases

Configuration ships like code

Changes are gathered into a release, reviewed, and published — and a rollback records who reversed it and why, in the same transaction as the move itself. What a tenant runs is a version somebody published, not whatever was edited last.

Rollback is a record, not a revert

VERSIONSagent profile snapshots

What runs is what was published

An agent profile has versions and a published snapshot, and the snapshot is what executes. Editing the row does not change behaviour until a version is published, so a live agent cannot be altered halfway through somebody’s afternoon — and what ran last week can still be read exactly as it ran.

The published version runs

ENVIRONMENTSenvironments · feature flags

Development is not production

Environment travels on the credential and on every record. Flags, model bindings and policies can differ between environments and move between them through the same governed release path — so “it worked in development” is a statement about a scope the platform actually enforces rather than a hope.

The scope is on the record

WORKS WITH WHAT YOU RUN

No new stack
to adopt first.

A2A Matrix sits beside the identity provider, secret backend, model accounts and database an organisation already has, and uses them rather than replacing them. What follows is what the platform does today; what is being added next is named on the direction, with its own label.

IDENTITY & OIDCYour directory stays the directory

Every service verifies the caller against an OIDC provider that publishes a discovery document and a key set — Keycloak is what this deployment runs, and the same path is what an Entra ID or Okta realm presents. Keys are fetched by key id and refreshed on rotation, asymmetric algorithms only, with an unknown key id rate-limited so it cannot be turned into traffic aimed at your identity provider.

SECRETS & BYOKYour models, your keys, your vault

A tenant registers its own secret store and the platform resolves that tenant’s provider credentials from it at call time. The database holds the path and the time it was last rotated, never the secret, and a tenant that has asked to fail closed is refused rather than quietly served the platform’s own key. Which store kinds are served today is named on the direction below, where a status belongs.

MODELS, YOURS OR OURSAny endpoint that speaks the format

Provider formats are configuration rows rather than a hard-coded list: the OpenAI chat shape is built in, and a provider that speaks it — a commercial account or an endpoint you host yourself — is registered rather than coded for. Adding one is configuration with a record, not a release. Per-tenant keys mean a company’s spend, quota and choice of provider stay its own.

TOOLS OVER MCPOpen protocol, not brittle glue

Tools arrive over the Model Context Protocol. A server is registered, certified before it is assignable and re-certified on a schedule; each call is authorised against the caller before dispatch, and an outbound target is resolved, validated and then pinned to the one address that was checked, so a hostname cannot answer differently for the check and the call.

RUNNING IT IN YOUR OWN ESTATE

A scope,
and a first decision.

Anyone can start a hosted workspace in a minute. Running the platform on your own infrastructure, against your real systems, is a deliberate evaluation — this is what it needs, and what it asks you to decide first.

WHAT IT RUNS ON

Infrastructure you already have

Postgres for state and evidence, Redis for queues, Qdrant for vectors, an S3-compatible bucket for artifacts, and an OIDC provider for identity. Plus a model account — or an OpenAI-compatible endpoint you host yourself, which removes the last outbound hop. The platform itself is nineteen binaries; there is no interpreter or package tree to keep patched beside them.

Postgres / Redis / Qdrant / Object store / OIDC

WHAT YOU DECIDE FIRST

Four decisions, before the first run

Which actions a human must approve and who those people are. What each class of data may look like when it reaches a model. Which model does which work, and on whose key. And what an agent may reach on day one — because the useful first scope is usually narrower than the one that gets proposed.

Approvals / Exposure / Models / Reach

WHAT A FIRST USE CASE LOOKS LIKE

One workflow, one connector, one approver

A process someone already owns, with a step that is worth automating and a decision that is worth keeping human. That is enough to exercise the whole path — identity, policy, an approval, a tool call, an artifact and the record — and small enough that the evidence is readable by the person who owns the process.

Own it / Wire it / Watch the record

WHAT YOU GET BACK

The console, the ledger, and your data

Operators see runs, approvals, queues, service health and the evidence behind any decision. Auditors get a per-tenant chain they can verify and export. If you stop, the state is in your Postgres, the files are in your bucket and the evidence exports — the exit is an ordinary operation rather than a negotiation.

Operate / Verify / Export

Where to look next: the two execution models if you are deciding how work should be shaped, how you will know it works before you commit to a second use case, building with the platform if your team will compose agents themselves, what it sits beside for the integration review, and the questions — which are the ones evaluations actually reach, answered including where the answer is no.

BUILD WITH INTENTION

Give intelligence
a responsible next step.

Start a workspace in a minute, or bring a real enterprise use case and we will map the agents, the integrations, the approval roles, and the people who stay in control.