Architecture

Four planes, one door between them and the outside world, and vendor types that die at the adapter boundary.

#The shape

#What each layer owns

Surfaces

The console and the A2A/Orchestrate descriptors. Both are clients of the same capability registry - the console has no privileged path, and the descriptors are generated rather than maintained, so they cannot describe a policy that is not enforced.

Gateway

The only door. Every call, from a human session or an agent or an external partner, passes the same nine checks in the same order. See The gateway.

Behaviour

Agents decide what to attempt; the gateway decides what is permitted. The knowledge plane answers questions with provenance or abstains. The scheduler makes follow-up periodic rather than opportunistic.

Ports

Canonical types. Nothing above this line knows the string serviceReview, the code A1, or that a submission answers 202.

Adapters

Where vendor vocabulary lives and dies. Three per port: mock for development, replay for contract tests, live for production. Swapping one is a config row, not a code change.

#Why ports matter here specifically

CMS-0057-F requires impacted payers to stand up a FHIR prior authorization API from 1 January 2027. X12 278 does not go away when that happens - both rails run, for years, payer by payer. The adapter boundary is what lets a payer move rails without the agents noticing.