Operationalizations

Primitives are building blocks. Operationalizations are how they combine into production patterns. This page documents the real workflows that run daily in an internal multi-agent platform — 5+ concurrent AI agents, built on hummbl-governance primitives (public, verifiable).

Pattern: Circuit-breaker-wrapped external calls

Every external API call (GitHub, Linear, Google Calendar, cost tracking) is wrapped in a CircuitBreaker. When an adapter fails N consecutive times, the circuit opens and subsequent calls fail fast instead of hanging. After a cooldown, the circuit enters HALF_OPEN and probes with a single request. If the probe succeeds, the circuit closes and normal operation resumes.

Primitives composed

• CircuitBreaker — failure detection and isolation
• AuditLog — records every trip and recovery
• HealthProbe — exposes circuit state in the health endpoint

What it prevents

Cascade failures when an external service degrades. Without the circuit breaker, a slow GitHub API would block the entire briefing pipeline. With it, the briefing degrades gracefully — GitHub data is skipped, the rest of the briefing still ships.

Pattern: Kill switch + circuit breaker defense in depth

The KillSwitch is the manual emergency stop. The CircuitBreaker is the automatic failure isolation. They work in layers: the circuit breaker handles transient failures automatically; the kill switch handles catastrophic failures that require human judgment.

Primitives composed

• KillSwitch — 4-mode manual stop (DISENGAGED / HALT_NONCRITICAL / HALT_ALL / EMERGENCY)
• CircuitBreaker — automatic failure isolation
• HealthProbe — unified status across both

What it prevents

Uncontrolled agent operation during incidents. HALT_NONCRITICAL stops non-essential agents while keeping monitoring alive. EMERGENCY stops everything. The circuit breaker provides automatic protection between human interventions.

Pattern: Delegation chain with capability fence

When an agent receives a task, it gets a DelegationToken signed with HMAC-SHA256. The token specifies what the agent can do (scope), how deep it can delegate (chain depth), and when it expires. The CapabilityFence enforces the token's scope at every tool call — the agent literally cannot call tools outside its fence.

Primitives composed

• DelegationToken — signed authorization with chain depth
• DelegationContext — binds token to task/agent/session
• CapabilityFence — enforces scope at tool-call time
• AgentRegistry — verifies agent identity before issuing token
• AuditLog — records every delegation and every fence check

What it prevents

Privilege escalation and scope violation. An agent that tries to call a tool outside its fence is denied and the attempt is logged. An agent that tries to delegate beyond its chain depth is denied. The audit trail makes every violation visible.

Pattern: Coordination bus with typed messages

Multi-agent coordination runs through an append-only TSV BusWriter with flock-based file locking. Agents post typed messages (PROPOSAL, ACK, STATUS, SITREP, BLOCKED, DECISION, MILESTONE). Every message is durable, ordered, and auditable. The bus is the single source of truth for fleet state.

Primitives composed

• BusWriter — append-only TSV with flock locking
• LamportClock — causal ordering across agents
• AuditLog — bus messages are also audit events

What it prevents

Lost messages, race conditions, and uncoordinated actions. The append-only design means messages cannot be silently deleted. The flock locking means concurrent writes are safe. The typed messages mean agents can filter for what matters to them.

Pattern: Output validation pipeline

Before any agent output reaches a user or downstream system, it passes through a validation pipeline: SchemaValidator checks structure, OutputValidator checks content and length, InjectionDetector checks for prompt injection, PIIDetector checks for leaked PII, and BlocklistFilter checks against content blocklists.

Primitives composed

• SchemaValidator — structural validation
• OutputValidator — content and length bounds
• InjectionDetector — prompt injection detection
• PIIDetector — PII filtering
• BlocklistFilter — content blocklist

What it prevents

Malformed, injected, PII-leaking, or prohibited content from reaching users. Each validator catches a different failure class. The pipeline is composable — add or remove validators per use case.

Pattern: Cost governance with per-agent budgets

Every agent has a CostGovernor with configurable budget caps. The governor tracks token costs, API calls, and compute usage. When an agent approaches its budget, it receives a warning. When it exceeds the budget, the governor halts the agent and logs the event.

Primitives composed

• CostGovernor — per-agent budget enforcement
• AuditLog — records every budget event
• HealthProbe — exposes cost status in health endpoint

What it prevents

Runaway costs from agent loops, infinite retries, or model escalation. The governor makes costs visible and enforceable, not just tracked.

Pattern: STRIDE threat modeling mapped to primitives

The StrideMapper maps each STRIDE threat category to the primitives that mitigate it. This is not theoretical — it is the actual threat model used in production.

Pattern: Compliance mapping as code

The ComplianceMapper automatically maps governance primitive usage to NIST AI RMF, EU AI Act, ISO 42001, and NIST CSF 2.0 requirements. When an audit log entry is created, the mapper determines which compliance requirements it satisfies and records the mapping. This turns compliance from a manual reporting exercise into an automated byproduct of running the system.

Primitives composed

• ComplianceMapper — framework crosswalk
• AuditLog — source of governance events
• StrideMapper — threat model input

See also: the primitives catalog and the methods of organization that structure these patterns.