Ideas · Builder Notes
Admitting system triggers without weakening governance
Kognita alpha admits system triggers only when the authenticated client configuration lists them, and keeps them alive across live polls.
Context
Scheduled jobs and system events are not agents with credentials, but they still need to call governed tools.
Decision
- A system trigger is admitted only when listed in the client configuration.
- It skips only the workload-credential check; every other check applies.
- Live polls recheck that the trigger is still admitted.
Why
A narrow exception, recorded in evidence, is better than a broad bypass.
Outcome
System triggers work through the gateway and MCP proxy.
Open
Trigger lists are configuration and need their own review.
When you make an exception, make it the smallest possible and evidence it.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #81, Kognita PR #106 in the Kognita repository.