Management Command Contract
Purpose
Prevent dashboards, agents, and shared operator tooling from becoming unbounded writers. A Management command is an explicit request to a domain authority; it is never a hidden database mutation or a side effect of reading a panel.
Required envelope
| Field | Meaning |
|---|---|
| Command type and version | Stable, allowlisted operation with versioned semantics |
| Target authority | Product/runtime that alone may accept and execute the command |
| Actor and capability | Human or agent identity plus the exact delegated permission |
| Scope | Product, resource IDs, data classification, and expiry |
| Intent and reason | What outcome is requested and why |
| Preconditions | Version, state, evidence, and safety predicates checked before execution |
| Idempotency key | Retry identity that cannot repeat the effect |
| Preview | Expected effects and prohibited effects before approval |
| Approval | Policy and human authority required for this command class |
| Expected evidence | Signals that prove success, partial success, or failure |
| Recovery | Rollback or compensating command and its own authority |
Lifecycle
draft intent -> authorize -> preview -> approve -> execute at owner
-> immutable receipt -> verify evidence -> close or compensate
The receipt records the command version, actor, capability, target, accepted preconditions, execution result, evidence references, and recovery state. Audit failure must not be silently treated as command success.
Privacy and authority
- CareerVector commands are workspace-scoped and revocable; no generic workspace-query command exists.
- Internals commands operate through named orchestration, corpus, or maintenance APIs, never arbitrary SQL.
- JobCache customer support commands are separate from public-corpus commands.
- An agent can propose or execute only within the same declared capability model as a human.
Acceptance evidence
- Repeating the same command key cannot repeat its effect.
- Failed preconditions cause no mutation.
- Every successful effect has a durable receipt and observable verification.
- Every partially successful effect names the compensation path.
- Removing the Management UI does not remove the target runtime's command validator.
Open decisions
- Approval classes and separation of duties.
- Receipt storage and retention per product.
- Emergency/break-glass policy.
- Common envelope versus product-specific typed unions.