Build on it

The Kubernetes RBAC pattern pointed at Postgres or MySQL. An on-call engineer gets read on the production replica for four hours, behind a two-person quorum with one human. The provider reads the live role table (pg_catalog) as its canonical projection, applies GRANT and REVOKE, and attests. A GRANT made by hand is OUTOFSYNC on the next pass. The TTL in the approved envelope ends the access without anyone remembering to.

You write: one provider over the database’s role catalog and an intent type in bitcd.yaml. TTL enforcement, drift and revoke-by-tombstone already exist.

Approve the artifact, not the pull request. The release digest for each environment is a governed value. Promotion to production is a quorum with a human floor. The deploy runner is an executor that applies only a committed digest. Machine notaries turn the pre-flight checks into votes: signature verified, SBOM clean, staging soak passed. The human signs a release that already passed them. A rollback is a governed revision; an emergency stop is a tombstone.

You write: a provider over the deploy target, or a runner that reads the committed digest, plus notary skills for the pre-flight checks. The terraform-backend shim already makes a Terraform run apply only state whose digest the chain holds.

Most flag systems fail open: when the flag service is unreachable, code runs on whatever it last cached. Put the flag set under a prefix and give every service the loader instead of an SDK poll. Fresh and verified runs. Briefly stale runs inside a bounded grace window. Tampered or tombstoned halts the risky path. The company-wide kill switch is a tombstone every fleet sees on its next poll. A flag that gates something dangerous can carry a stronger quorum than one that changes a button colour.

You write: a flag schema and the loader wiring in your services. The RUN/HOLD/HALT gate is the manifest loader; it does not care that the payload was an allowlist.

Apex records, MX and the WAF ruleset are one registrar login away from a silent hijack. Declare them under a prefix and let a provider over the registrar or CDN API converge and attest. A console edit that bypassed governance shows as drift. MX and apex changes get min_humans ≥ 1; a routine CNAME does not.

You write: a provider over the DNS or CDN API. Strip the provider’s decoration in the canonical projection so digests compare exactly, as the RBAC provider does.

Govern references, never material. Blob storage is integrity-only and readable. The governed value says which secret is live: vault path X, KMS key version 7, rotated on a date. The material stays in the vault. Rotation becomes a quorum decision with an audit trail. The executor flips the reference and attests. A service still pinning the old version shows as drift. Anyone can verify the rotation policy is followed without seeing a secret.

You write: a schema for secret references and a small executor over the vault’s API. The secret-shaped-value lint in bitcd.yaml refuses material at compile time.

The capability ledger pins the digest of an agent’s voting skill. The same pattern pins anything a runtime must not swap silently: the model version, the system prompt, the policy pack, the container image. A governed manifest carries the artifact digest. The loader refuses a mismatch. Each replica attests what it adopted, k-of-n. Whether all fifty replicas run the reviewed prompt becomes a chain query the replicas cannot game.

You write: a manifest schema for the artifact kind and host wiring that hands the loader the bytes to verify. The binary_digest mechanics ship in the capability ledger.

Treasury operations are intent types: who gets paid what, under which quorum. Spend caps are bounded params, allowlisted counterparties are enums, min_humans sits on anything above the routine tier, and an agent proposer that looks wrong gets escalated. Execution is a token transfer the executor performs only for committed intents. Every refusal is on-chain evidence.

You write: an intent type and an executor that moves the funds. The policy gate, human floor and TTL machinery do not change.

This one exists, as the aws-iam connector, and it answers the question every provider must: what is the live object a grant maps to? A Kubernetes grant is a RoleBinding, a named object that exists or not. IAM has no container for “this principal holds that policy set”, so the provider defines one: the principal’s delegated slice, derived from the verified manifest and never from local configuration.

Reuse: when your target has no natural binding object, define the governed slice explicitly and derive its universe from the manifest.