Supreme policy for this project. Wins over agent prompts on conflict. Dev catalog default: kg_agentic_rag.
- Least-privilege UC grants; App identity vs Jobs identity separation
- Bind
principal_idfrom server auth — never from the browser principal_idon privatechat,kg_staging,kg_memory, and personal graph rows- Stage extractions in
kg_stagingbefore promote tokg_core/kg_memory - Provenance for promoted nodes, edges, facts
- Filter personal retrieval by
principal_id ingest_statusgate: searchable only whenindexedorlearned- Security Reviewer on UC grants, publish/export, and cross-individual share
- Commit credentials, workspace hostnames, or identity UUIDs
- Log
databricks auth describe,~/.databrickscfg, or.env - Write
kg_core/kg_memoryfrom chat without a promote job - Return another user’s chat, memory, or documents
- Export
chat.*/kg_memory.*in packs by default - Run UC DDL or prod catalog changes without the right task / approval
- Publish = exportable
kg_corespine + pack manifest only - Subscribe = consent row (
memory_shares); no private-mind copy - Restart ontology keeps packs; Unpublish removes the publisher’s packs
| Rule | Requirement |
|---|---|
| No machine paths | No absolute user paths in tracked files |
| No secrets in repo | Profile name in .env only; auth in ~/.databrickscfg |
| Portable MCP | If .cursor/mcp.json exists: ${workspaceFolder} only |
| Catalog | Dev: kg_agentic_rag |
| Volume uploads | /Volumes/kg_agentic_rag/source/user_uploads/{principal_id}/{document_id}/ |
Do not mix SQL_WAREHOUSE_NAME (CLI lookup) with SQL_WAREHOUSE (Apps binding). Job IDs come from app.yaml valueFrom bindings.
scripts/kg check # before commit / push- Governance script passes
- No credentials in diff
- Persona / task scope respected (if using agents)
- Principal isolation intact
- No ungoverned personal-memory export
- Security sign-off when the change touches grants / share / clean / unpublish
Single register of completed gates (detail worksheets retired).
| Gate | Scope | Result | Date |
|---|---|---|---|
| T5 | Phase 1 foundation (env, Lakebase, UC, sync) | APPROVED (conditions) | 2026-07-06 |
| T12 | Phase 2 UC grants + upload policy | APPROVED (conditions) | 2026-07-06 |
| T27 | Promotion policies (memory/graph/drain) | APPROVED (conditions) | 2026-07-06 |
| T37 | Pre-deploy hardening | APPROVED for dev | 2026-07-06 |
| T55 | Ontology inspectability | APPROVED | 2026-07-09 |
| T60 | MindGraph browser cache | APPROVED | 2026-07-09 |
| T63 | Publish path + subscribe boundaries | APPROVED | 2026-07-09 |
| T68 | Staged clean / restart ontology | APPROVED | 2026-07-09 |
| T80 | Phase 6/7 UX + hygiene | APPROVED | 2026-07-10 |
| T83 | Unpublish published paths | APPROVED (residual: prefer unique pack ids at publish) | 2026-07-10 |
| T84 | Learn empty-session soft-skip + API/UI guard | APPROVED (dev) — no staging write on skip; owned-session enqueue | 2026-07-11 |
| T85 | Personal kg_core query match + edges in chat pack | APPROVED (dev) — SQL always principal_id-scoped; caps applied |
2026-07-11 |
| T91 | Phase 8 frontend IA (Ask/Input/Publish/Learning) | APPROVED (dev) | 2026-07-14 |
| T98 | Phase 9 Knowledge Sharing (walk_rules, preview, clearing, episodes, attend interpreter) | APPROVED (dev) — residuals: apply corrections grant in workspace; manual clearing→version | 2026-07-14 |
- Stronger pack-id uniqueness at publish
- Prod/staging catalog separation + continuous grant drift checks
- Broader retention / incident process before regulated use
This is a dev prototype. More governance is required before production multi-tenant use.