13ARCHITECTURE

Core Data Model & Event Schema

The normalized agent-authority-action graph becomes the foundation for cross-vendor security intelligence.

Priority: P0
Phase: Foundation
Primary owner: Platform Eng / Data
Status: Blueprint

Objective

The data model is a strategic asset. If Agent Trust Cloud normalizes agent identity, delegation, tools, resources and actions across vendors, every downstream module—policy, risk, audit, FinOps and incident response—gets stronger. Avoid vendor-specific event models leaking into the core domain.

What to build

Principal objects: human, workload, agent, service account, application and external actor.
Agent objects: owner, purpose, provider, model, framework, environment, trust state, capabilities and lifecycle state.
Authority graph: who delegated to whom, what scope, when, through which credential and for what purpose.
Action events: requested tool, operation, target resource, parameters fingerprint, decision, approval, outcome and cost.
Evidence objects: logs, prompts/hashes, policy versions, approvals, external alerts and incident links.

Implementation decisions

Use globally unique immutable IDs; store display names separately.
Version policy, identity and agent configuration so past decisions can be reconstructed.
Normalize resource URIs and action verbs into a canonical vocabulary while preserving raw vendor fields.
Design PII/secret classification metadata into schemas rather than adding it later.

Definition of done

Any runtime decision can be replayed using stored context and policy version.
Vendor connectors can evolve without breaking the canonical model.
Cross-agent investigations can traverse delegation and resource graphs.

Success metrics

Schema compatibility failures
Unmapped vendor event fields
Event correlation success rate
Evidence reconstruction success

DATA MOAT

The normalized agent-authority-action graph becomes the foundation for cross-vendor security intelligence.