Architecture Overview and Interfaces
CDPG separates governance, data movement, and governed autonomous execution into three cooperating planes. The separation is about responsibility, not deployment: planes may share a cluster, but they do not share business ownership.
Status: Partially implemented. Control and Data Plane services are available with named gaps; the Agentic Plane is implemented for local integration but not deployable through GitOps. See Current & Target.
planes_and_interfaces · govern, serve, act
actorsControl PlaneData PlaneAgentic Planeshared contracts & events
Platform goals
- Enable providers to publish discoverable resources and control how they are used.
- Enable consumers and applications to discover, obtain entitlement, and access data through standard APIs.
- Preserve organization boundaries, provider ownership, auditability, and revocation across synchronous and asynchronous paths.
- Support real-time, temporal, spatial, file, subscription, and standards-native access models.
- Let agents act under narrow, time-bound, reviewable authority without turning model output into policy.
- Run the same service images under centrally operated or configuration-selected federated topologies.
Actors and personas
| Actor | Primary goals | Principal type |
|---|---|---|
| Consumer | Discover, request, purchase, query, download, or subscribe | User or application |
| Provider | Onboard resources, upload data, publish products, grant and revoke access | User within an organization |
| Organization administrator | Manage membership and govern organization-owned resources | Privileged user scoped to an organization |
| Platform operator | Operate infrastructure, registries, policy distribution, incidents, and audit | Privileged workload/user with narrowly scoped operations |
| Client application | Integrate programmatically without a human session | Application/workload principal |
| Agent owner | Register an agent, delegate authority, approve risk, review activity, revoke | User |
| AI agent | Propose tools within a delegation and template | Agent actor plus runtime workload |
| External provider | Supply identity, payments, email, object storage, source data, or LLM capability | External system with protocol-specific trust |
Plane responsibilities
| Plane | Owns | Does not own |
|---|---|---|
| Control Plane | Identity-linked profiles and organizations, resource metadata, grants, authorization decisions, commerce, registries, credits, audit, notifications, governance | Resource payload delivery and model reasoning |
| Data Plane | Ingestion, storage, query, spatial/temporal processing, files, subscriptions, data filtering and delivery | Grant authoring, identity issuance, global policy evaluation |
| Agentic Plane | Agent/template lifecycle, sessions, token exchange, tool mediation, HITL, kill switch, agent audit context | Independent standing authority or direct datastore access |
| Shared platform | Cross-cutting service runtime, contracts, identity plumbing, events, persistence, cache, health, observability, resilience | Business rules or service-owned data |
Standard interfaces
| Interface | Purpose | Primary owners | Status |
|---|---|---|---|
| Identity (OIDC/OAuth 2.0) | Authenticate users, applications, agents, and workloads; publish keys; exchange tokens | Keycloak, Gateway, Agent Runtime | Implemented / Partially implemented |
| Discovery (JSON-LD/search) | Register and find resource metadata and access capabilities | Catalogue | Implemented |
| Policy administration | Create, validate, list, expire, and revoke grants and access requests | Policy Service | Implemented with projection gaps |
| Authorization | Authorize(subject, actor, operation, resource, context) → decision + obligations | Gateway/application PEP, dx-authz-go, OpenFGA, OPA | Planned composite target |
| Resource access | NGSI-LD entity/temporal queries and subscriptions | Data Plane | Partially implemented |
| Geospatial access | OGC Features, Tiles, Coverages, Processes, Records | OGC Data Plane | Partially implemented |
| File exchange | Multipart upload, processing, listing, preview, download, object access | File Exchange | Partially implemented |
| Internal service API | Typed, workload-authenticated calls between Go services | gRPC platform surface and service protobufs | In development |
| Domain events | Versioned facts and durable projections | RabbitMQ, platform event bus, outboxes | Partially implemented |
| Agent tools | Discover and invoke schema-bound operations under delegation and risk policy | MCP Gateway | Partially implemented |
Deployment models and configuration
- Central: the full fleet runs behind one gateway in a Kubernetes cluster or local Compose environment.
- Federated: selected data and trust components run in an independently operated network; this shape is Deferred until its trust and conformance gates close.
- Feature gates: Agentic Plane and federation components are absent or disabled unless deliberately selected.
- Persistence: new deployments provision service-owned databases/schemas through versioned Go migrations. Schema execution is an explicit deployment mode with one migration actor.
- Environment: configuration is typed and environment-driven; secrets are injected by a secret manager and never committed.
Continue with System Architecture, then the Control Plane, Data Plane, Agentic Plane, and Security Architecture.