> ## Documentation Index
> Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Product model

> How Checkfu's authored resources, durable execution, trust boundaries, and extensions fit together.

Checkfu keeps product truth independent from any particular model, harness, sandbox provider, channel, or authoring interface.

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
Organization
└── Tenant, normally implicit
    └── Workspace
        ├── Agent → AgentVersion
        ├── Environment
        ├── Session → SessionThread, Turn, Run, RunAttempt
        ├── Vault → Credential
        ├── Connection
        ├── File
        ├── MemoryStore → MemoryVersion
        ├── Skill → SkillVersion
        ├── Automation → AutomationRun
        └── AgentBlueprint and AutomationGraph extensions
```

## Authored configuration

An **Agent** is a mutable Workspace-scoped resource. Creating or materially changing it creates the next immutable **AgentVersion**. The Version records exactly which instructions, tools, and other admitted Agent configuration later work can select.

An **Environment** is reusable execution authority. It identifies the environment definition and constrains the runtime tuple that may realize work. Models and harnesses remain replaceable execution lanes; they do not wrap or rename Agent, Environment, or Session.

An **AgentBlueprint** is a portable versioned package that can plan or apply desired resources. It is not an Agent and does not execute. An **AutomationGraph** describes authored composition and reconciliation. It is not a firing-time runtime interpreter.

## Durable execution

Session admission resolves and freezes one AgentVersion plus Environment authority. The Session event log is durable execution truth for the ongoing interaction or task.

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
Session
├── SessionThread
│   └── Turn
│       └── Run
│           └── RunAttempt
└── ordered events for accepted input, execution, waits, recovery, and settlement
```

A Session can contain multiple Runs and each Run can have multiple attempts. Child Runs, subagents, handoff, continuation, and checkpoints remain inside the same Session truth. Request duration, stream closure, runtime narration, and harness-native transcripts do not settle the Session.

The Session log does not absorb every other authority. Model-plane receipts remain authoritative for model Usage. The trusted effect boundary remains authoritative for provider effects. ActionApproval, Connection, MemoryStore, Audit, and other specialized aggregates keep their own lifecycle while projecting Session-visible evidence where required.

## Resources and trust

Files, MemoryStores, Skills, Vaults, Credentials, Connections, and Tools remain distinct resources. Their existence or selection does not grant permission.

<Snippet file="trust-path.md" />

A CustomTool declared by the admitted Agent is deliberately different. Its ActionPolicy can allow, deny, or require ActionApproval. Customer code executes the handler and returns `user.custom_tool_result` to the same parked Run. The CustomTool path has no inherent Connection or PermissionAssignment gate.

Custodied Credential values resolve only at the trusted effect boundary. They do not enter Agent instructions, model context, harness configuration, Session events, or sandbox workloads. Customers must still avoid putting their own secrets into prompts, Files, Memory, Tool arguments, or results.

## Composition and presentation

```text theme={"theme":{"light":"github-light","dark":"github-dark"}}
AutomationGraph ── plans and applies desired composition
Automation ─────── owns durable firing configuration
AutomationRun ─── records one firing
Session ───────── owns Agent execution truth
Outcome ───────── owns bounded same-Session revision
Channel ───────── provides ingress and presentation around Session truth
Computer ──────── provides provider-neutral capability
Screen ───────── owns durable public observation and logical geometry
```

Specialized resources retain their runtime authority. A provider callback, channel message, or Computer observation never becomes a second transcript.

## Authoring ownership

UI, HTTP, SDK, CLI, and MCP act through canonical resource operations. YAML and Git are desired-state source forms that compile or plan through those operations.

Desired configuration has zero or one active authoring owner. A source form is not another scheduler, policy authority, credential broker, execution runtime, transcript, or reconciler.

## Retention, Usage, and support

Standard retention and ZDR have materially different persistence, recovery, replay, export, and presentation semantics. Authoritative Usage facts, not traces or runtime narration, support Budgets and quotas.

<Snippet file="support-posture.md" />

Use [capability status](/getting-started/status) for live posture and the [glossary](/concepts/glossary) for exact public definitions.