Skip to main content
Checkfu keeps product truth independent from any particular model, harness, sandbox provider, channel, or authoring interface.

​
Authored configuration

An Agent is a mutable Workspace-scoped resource. Creating or materially changing it creates the next immutable AgentVersion. The Version records exactly which instructions, tools, and other admitted Agent configuration later work can select. An Environment is reusable execution authority. It identifies the environment definition and constrains the runtime tuple that may realize work. Models and harnesses remain replaceable execution lanes; they do not wrap or rename Agent, Environment, or Session. An AgentBlueprint is a portable versioned package that can plan or apply desired resources. It is not an Agent and does not execute. An AutomationGraph describes authored composition and reconciliation. It is not a firing-time runtime interpreter.

​
Durable execution

Session admission resolves and freezes one AgentVersion plus Environment authority. The Session event log is durable execution truth for the ongoing interaction or task.
A Session can contain multiple Runs and each Run can have multiple attempts. Child Runs, subagents, handoff, continuation, and checkpoints remain inside the same Session truth. Request duration, stream closure, runtime narration, and harness-native transcripts do not settle the Session. The Session log does not absorb every other authority. Model-plane receipts remain authoritative for model Usage. The trusted effect boundary remains authoritative for provider effects. ActionApproval, Connection, MemoryStore, Audit, and other specialized aggregates keep their own lifecycle while projecting Session-visible evidence where required.

​
Resources and trust

Files, MemoryStores, Skills, Vaults, Credentials, Connections, and Tools remain distinct resources. Their existence or selection does not grant permission. A CustomTool declared by the admitted Agent is deliberately different. Its ActionPolicy can allow, deny, or require ActionApproval. Customer code executes the handler and returns user.custom_tool_result to the same parked Run. The CustomTool path has no inherent Connection or PermissionAssignment gate. Custodied Credential values resolve only at the trusted effect boundary. They do not enter Agent instructions, model context, harness configuration, Session events, or sandbox workloads. Customers must still avoid putting their own secrets into prompts, Files, Memory, Tool arguments, or results.

​
Composition and presentation

Specialized resources retain their runtime authority. A provider callback, channel message, or Computer observation never becomes a second transcript.

​
Authoring ownership

UI, HTTP, SDK, CLI, and MCP act through canonical resource operations. YAML and Git are desired-state source forms that compile or plan through those operations. Desired configuration has zero or one active authoring owner. A source form is not another scheduler, policy authority, credential broker, execution runtime, transcript, or reconciler.

​
Retention, Usage, and support

Standard retention and ZDR have materially different persistence, recovery, replay, export, and presentation semantics. Authoritative Usage facts, not traces or runtime narration, support Budgets and quotas. Use capability status for live posture and the glossary for exact public definitions.