Vendor / operator
The vendor’s application, workflow engine, MCP client, A2A client, or optional operator-side agent creates the request.
One governed path from vendor intent to customer-local execution.
Legation separates vendor orchestration, routing, and customer enforcement into explicit trust boundaries. The customer’s Embassy is where workloads are verified, authorized, executed, observed, and stopped.
01 / Trust boundaries
Three operational zones. One controlled relationship.
Legation hub
The hub authenticates, routes, queues, coordinates, and observes fleet connectivity without becoming the customer’s local execution environment.
Customer Embassy
The Embassy verifies the workload and request, enforces treaty and mandate rules, invokes local services, produces evidence, and controls what may return.
Core architectural ruleThe hub coordinates. The Embassy enforces. The customer keeps the final policy and execution boundary inside its own environment.
02 / Request lifecycle
From application call to governed result.
1. Address
The vendor application identifies the customer Embassy and target workload: an MCP service, an A2A agent, or a native service.
2. Seal and authenticate
Legation binds the request to workload identity, authorization context, anti-replay state, and policy metadata.
3. Route
The hub forwards the sealed request over the outbound-established secure link and correlates the response path.
4. Admit and enforce
The Embassy verifies identity, treaty, mandate, cargo, and policy before local execution is allowed.
5. Execute locally
An approved agent, MCP server, or other service works next to customer data and systems.
6. Project and return
The Embassy governs the output, records evidence, and returns only the permitted result.
03 / Invocation modes
Known-call, agentic, or native.
| Mode | Operator side | Customer side | Best for |
|---|---|---|---|
| Known tool call | Application or MCP client | MCP server (in-VPC) | Known tool calls and deterministic operations |
| A2A delegation | Application or operator-side agent | Agent → MCP server | Goals, reasoning, planning, multi-step work |
| Native service | Application SDK / API | Customer service | Traditional software operations without agents |
The operator-side agent is optionalA reference operator-side agent can demonstrate agentic orchestration, but Legation does not require the vendor to use it—or any agent—when integrating its application. In every mode the customer-side workload runs in-VPC and returns only a governed projection—never raw data.
04 / Data path
Move the operation to the data—not the data to the operation.
Customer-sensitive data is processed inside the customer boundary. The customer-side workload returns a governed projection, decision, structure, or result rather than unrestricted source data.
What can stay customer-local
- Database records and files
- Credentials and internal APIs
- Regulated evidence and telemetry
- Customer-side tool execution
- Local policy and audit records
What may cross back
- Approved task results
- Redacted or projected structures
- Decision records
- Attestation and evidence references
- Operational status
05 / Failure behavior
Connectivity failure cannot become a governance bypass.
The Embassy is designed to retain local policy enforcement during degraded hub connectivity. Queued work, replay boundaries, regional routing, and explicit fail-closed behavior prevent a control-plane outage from silently turning into unrestricted execution.
Regional loss
Latency and health-based routing can move Embassy connections to a surviving region.
Hub isolation
The customer-side enforcement boundary continues applying local policy rather than defaulting open.
Workload recall
Customer-controlled stop and recall mechanisms provide an explicit path to halt approved cargo.
06 / Platform components
A complete delivery and governance substrate.
| Layer | Representative components | Purpose |
|---|---|---|
| Envelope | Seal, Manifest, Enclave | Package, describe, verify, and govern approved cargo |
| Conduit | Ingress, Link, MCP | Transport requests and protocol operations across boundaries |
| Control plane | C2, Serve, Console | Coordinate Embassies, dispatch work, and operate fleets |
| Trust spine | Identity, Crypto, PQ Crypto, Custody, Transparency | Identity, key protection, proof, and cryptographic integrity |
| Proof | Compliance, Observability, CLI | Evidence, telemetry, validation, and operational workflows |