Architecture decisions
Opinionated – and reasoned.
Three decisions that set ATF apart from orchestration toolkits. In depth, with code and consequences.
01
Why we don't use a separate vector database for enterprise RAG, but force everything onto PostgreSQL/pgvector with row-level security
A second database is a second permission system. And the second permission system is the one missing in the audit.
Read more7 min read 02Why prompt-injection protection at the input is worthless if you don't scan the output of MCP tools
The attacker does not type into your chat window. They write into an email, a ticket or a PDF – and wait until your agent reads it.
Read more6 min read 03The EU AI Act in practice: what does the duty to provide evidence look like in code (Ed25519 instead of Word documents)?
A Word document describes what is supposed to happen. A signed evidence bundle proves what did happen.
Read more8 min read ADR
35 documented architecture decisions
Every decision with context, alternatives and consequences – versioned in the repository, not in a slide deck.
- 0001Record architecture decisions
- 0002Optional dependencies with graceful degradation
- 0003Safe condition evaluator instead of eval / new Function
- 0004Keep the graph engine lean by extracting cohesive helpers
- 0005Tenant data isolation model
- 0006Plugin trust boundary and isolation strategy
- 0007Reversible PII tokenization vault as a GraphEngineService decorator
- 0008Autopilot governance: human-approval gate and drift-guard circuit breaker
- 0009Declarative compliance policy engine and a separate auto-generated evidentiary dossier
- 0010Continuous automated red-teaming as a scheduled security-posture engine
- 0011Declarative, hot-reloadable tool-authorization policy
- 0012Self-optimizing flow loop with canary-gated, guarded auto-promotion
- 0013Backend-driven (BFF) OIDC session authentication for the operator plane
- 0014Split `index.ts`'s wiring into focused `src/bootstrap/*.ts` builders
- 0015Extensible PII Detector Pipeline
- 0016Multimodal (image/file) PII handling in the reversible vault
- 0017Decision-Provenance Explainability Card
- 0018FinOps budget forecasting + CO2/ESG accounting
- 0019Agent Identity Broker and cross-scope Revocation Console
- 0020Verifiable Evidence Bundle
- 0021Objective-Driven Routing / Solver-Loop
- 0022Org Skill Registry
- 0023Durable Agent Runtime
- 0024Shared security primitives in @atf/security-kit
- 0025Cross-service erasure orchestrated by the Runtime
- 0026Audit integrity: hash chain plus signed external anchors
- 0027Per-request CSP nonces for the operator plane
- 0028Converter isolation behind a Unix-socket sidecar
- 0029Verifiable execution receipts (COSE_Sign1 + Merkle log)
- 0030Asymmetric evidence chain: one Ed25519 key for independent verification
- 0031Shared rate-limit backends and an explicit REPLICAS knob
- 0032Propagating Search content-trust labels into execution taint
- 0033Extract throughput: continuous page refill, parallel job lanes, derived-PDF cache
- 0034Online (DB) flows shadow same-id file flows — visibly, precedence unchanged
- 0035Asymmetric transaction tokens and one audience per service