Management Command Contract
Purpose
Prevent dashboards, agents, and shared operator tooling from becoming unbounded writers. A Management command is an explicit request to a domain authority; it is never a hidden database mutation or a side effect of reading a panel.
Required envelope
| Field | Meaning |
|---|---|
| Command type and version | Stable, allowlisted operation with versioned semantics |
| Target authority | Product/runtime that alone may accept and execute the command |
| Actor and capability | Human or agent identity plus the exact delegated permission |
| Scope | Product, resource IDs, data classification, and expiry |
| Intent and reason | What outcome is requested and why |
| Preconditions | Version, state, evidence, and safety predicates checked before execution |
| Idempotency key | Retry identity that cannot repeat the effect |
| Preview | Expected effects and prohibited effects before approval |
| Approval | Policy and human authority required for this command class |
| Expected evidence | Signals that prove success, partial success, or failure |
| Recovery | Rollback or compensating command and its own authority |
Lifecycle
draft intent -> authorize -> preview -> approve -> execute at owner
-> immutable receipt -> verify evidence -> close or compensate
The receipt records the command version, actor, capability, target, accepted preconditions, execution result, evidence references, and recovery state. Audit failure must not be silently treated as command success.
Privacy and authority
- CareerVector has no first-party account authority. A workspace-specific support command needs an explicit, short-lived capability initiated by a holder of the private workspace link; no generic workspace-query command exists.
- TUI release and connector-manifest commands target CareerVector's distribution authority, not an individual device. A device update remains visible, locally initiated, and recoverable.
- Internals commands operate through named orchestration, corpus, or maintenance APIs, never arbitrary SQL.
- JobCache customer support commands are separate from public-corpus commands.
- An agent can propose or execute only within the same declared capability model as a human.
Acceptance evidence
- Repeating the same command key cannot repeat its effect.
- Failed preconditions cause no mutation.
- Every successful effect has a durable receipt and observable verification.
- Every partially successful effect names the compensation path.
- Removing the Management UI does not remove the target runtime's command validator.
Open decisions
- Approval classes and separation of duties.
- Receipt storage and retention per product.
- Emergency/break-glass policy.
- Common envelope versus product-specific typed unions.