Federated Context Governance
Overview
The tool-orchestration stack (discovery, selection, gateway, execution) assumes a
single coherent context. That assumption breaks when orchestration scales from
one developer to a team. When one developer configures an AI coding agent — a
CLAUDE.md, installed skills, hooks — the result is coherent and personalized.
When five developers do the same thing independently, the result is five
divergent architectures: each agent receives different instructions, applies
different patterns, and produces code shaped by different assumptions.
Marc Baselga documented this after deploying Claude Code across an engineering
team; Ben Erez called it the "unexpected tax." Two developers asking their agents
to "follow our coding standards" receive different standards if their contexts
diverge. The fragmentation follows a predictable progression:
individual optimization -> silent divergence -> visible inconsistency
-> coordination overhead
The chapter's three solution architectures are not competing options but LAYERS
of one federated architecture (Table 6-4), mapped to organizational scale:
| Scale |
Layer |
Tool |
Mechanism |
| Team |
Configuration as Code |
APM (Meppiel) |
versioned, composable skill/rule/prompt packages; apm install gives everyone the same base |
| Department |
Shared Knowledge Layer |
Nia Skills (Rakhmetzhanov) |
a central indexed knowledge base any agent queries |
| Enterprise |
Governance Control Plane |
Runtime (Jarjoura) |
business rules, constraints, ownership, decisions as infrastructure |
The architecture is FEDERATED, not centralized: teams own domain-specific context
but inherit an organizational base encoding nonnegotiable standards (security
policies, architectural constraints, code-review requirements, compliance rules).
Jarjoura's diagnosis is the decisive one: "Context failure, not AI failure."
Agents amplify whatever structure they receive; incomplete or inconsistent
structure produces amplified ambiguity at the speed of token generation.
When to Use
- Multiple developers or teams configure agents independently
- Code reviews reveal conflicting patterns produced by different agents
- Onboarding is hard because no single config represents team practice
- You need to enforce nonnegotiable standards (security/compliance) across teams
while letting teams keep their domain-specific extensions
Phrases that invoke this skill: "config drift", "our agents diverge", "context
governance", "federated config", "enforce the org base", "which governance
layer".
When NOT to Use
- A single developer's setup — one config is coherent by definition; there is
no drift to detect.
- As a code linter — it governs agent CONTEXT (settings, skills, rules), not
source code. Lint code with a code linter.
- As a secrets manager —
secrets_in_env_only is a policy KEY it enforces;
it does not store or rotate secrets.
- Where teams legitimately need different nonnegotiables — then the setting is
not actually nonnegotiable; move it to the negotiable set rather than forcing
false uniformity.
Process
| Step |
Input |
Action |
Output |
Verification |
| 1 |
Governance JSON (org_base + team_configs) |
lib.load_governance(path) |
Governance dict |
Has org_base (with nonnegotiable) and team_configs |
| 2 |
Team configs |
lib.detect_drift(configs) |
Settings that disagree + partial skills |
A key with differing values across ≥2 teams is reported |
| 3 |
Team configs |
lib.fragmentation_stage(configs) |
Stage on the four-stage progression |
More drift → later stage (coordination overhead) |
| 4 |
Org base + team configs |
lib.check_federation(org_base, teams) |
Per-team compliance + violations |
A team overriding a nonnegotiable key is flagged non-compliant |
| 5 |
Org base + one team |
lib.resolve_effective_config(org_base, team) |
Effective config with nonnegotiable keys locked to base |
A team's override of a locked key is ignored; base value wins |
| 6 |
Scale (team/department/enterprise) |
lib.recommend_layer(scale) |
The matching layer + tool + composition |
Larger scales inherit the smaller layers beneath |
Rationalizations
| Agent rationalization |
Documented rebuttal |
| "Each developer's config working for them is fine." |
It is fine individually and incoherent at the team level. Two agents given "follow our standards" produce different standards — the exact drift the chapter names. Individual coherence is not team coherence. |
| "Centralize all config in one file everyone shares." |
The architecture is FEDERATED, not centralized. Teams own domain-specific context; forcing one file loses the backend/frontend/data specialization that made per-team config valuable. Inherit the base, extend locally. |
| "A team can override any setting it needs to." |
Not the nonnegotiable ones. Security, architectural, and compliance keys are locked to the org base; a team disabling code review is a violation, not a preference. resolve_effective_config locks them by construction. |
| "Config drift is a people problem, not infrastructure." |
Jarjoura: "Context failure, not AI failure." Agent config is shared infrastructure requiring versioning, testing, deployment, and monitoring — the same engineering discipline as any other shared infra. |
| "Pick one governance tool and use it everywhere." |
The three layers map to scale and COMPOSE: Config-as-Code (team) inside Shared Knowledge (department) inside a Governance Control Plane (enterprise). One tool cannot span all three scales. |
Red Flags
- Zero drift reported across many independently-authored configs. Either the
configs are already governed (good) or the drift detector is not comparing the
right setting keys.
- A nonnegotiable violation reported as compliant. The federation check is
bypassed — a locked key must fail closed.
resolve_effective_config lets a team override a locked key. The lock is
inert; nonnegotiable keys must always resolve to the base value.- Fragmentation stuck at "individual optimization" despite obvious divergence.
The stage thresholds are miscalibrated for the number of configs.
- CLI
--help exits non-zero. SKILL.md / CLI mismatch; multi-harness invariant broken.
Non-Negotiable Verification
Run the benchmark battery.
python cli.py benchmark
Confirm drift is detected across teams, the fragmentation stage reflects it,
and the seeded rogue-frontend nonnegotiable violation (disabling
code_review_required) is caught.
Prove the lock holds in the effective config.
python cli.py effective rogue-frontend
code_review_required MUST resolve to True (the base value) even though the
team set it False.
Prove federation fails closed on the nonnegotiable.
python cli.py federate --json | python -c "import json,sys; d=json.load(sys.stdin); assert not d['all_compliant']"
Prove layer composition.
python cli.py layer enterprise
Enterprise scale must inherit [team, department, enterprise].
Security Posture
- Prompt injection. Context configs are the agent's instructions; a
compromised config is a direct injection vector. The nonnegotiable base is the
defense — security-relevant keys (
secrets_in_env_only, code_review_required)
are locked and a team cannot silently disable them.
- Data exfiltration. No network calls in
lib.py; governance is read from an
explicit path. In production the org base is itself a versioned, reviewed
artifact (the chapter's "agent config is shared infrastructure" point).
- Privilege escalation.
resolve_effective_config locking nonnegotiable keys
to the base is exactly the anti-escalation control — a team cannot grant itself
a laxer security posture than the org mandates.
Composition
- Wraps the whole tool-orchestration stack:
rag-mcp-tool-selection,
mcp-gateway-two-meta-tools, hierarchical-orchestration-router all assume a
coherent context — this skill is the layer that keeps it coherent at team scale.
- Pairs with
hierarchical-orchestration-router — hierarchical routing needs
a coherent per-domain context to route into; this governs that context.
- The nonnegotiable base is the natural home for the security policies from
information-flow-control-gate and the quality thresholds from
skill-quality-evaluator.
- Mirrors an org-baseline-plus-local-extensions config-sync discipline: an
org base every machine inherits, with local extensions composed on top.
Source Attribution
Distilled from Agentic GraphRAG (O'Reilly), Chapter 6 — Tool Orchestration,
section "Context Governance: The Missing Layer in Tool Orchestration". Named
references:
- Marc Baselga — documented config drift after team Claude Code deployment;
Ben Erez — the "unexpected tax"
- Daniel Meppiel — APM (Agent Package Manager), Configuration as Code (team scale)
- Arlan Rakhmetzhanov — Nia Skills, Shared Knowledge Layer (department scale)
- Daniel Jarjoura — Runtime, Governance Control Plane (enterprise scale);
"Context failure, not AI failure"
1---2name: federated-context-governance3description: Govern agent-configuration drift once tool orchestration scales from one developer to a team. Detects where independently-authored context configs (CLAUDE.md-style settings + installed skills) diverge, classifies the fragmentation stage, enforces a FEDERATED org base whose nonnegotiable settings (security, architectural, compliance) every team must inherit unchanged while owning their negotiable extensions, and routes a governance need to the right architectural layer (Config-as-Code / Shared Knowledge Layer / Governance Control Plane). Use when multiple developers or teams configure agents independently and their outputs are diverging. NOT for a single developer's setup (there is no drift), NOT a code linter (it governs agent CONTEXT, not source code), NOT a secrets manager (it flags a policy key, it does not store secrets).4---56# Federated Context Governance78## Overview910The tool-orchestration stack (discovery, selection, gateway, execution) assumes a11single coherent context. That assumption breaks when orchestration scales from12one developer to a team. When one developer configures an AI coding agent — a13CLAUDE.md, installed skills, hooks — the result is coherent and personalized.14When five developers do the same thing independently, the result is five15divergent architectures: each agent receives different instructions, applies16different patterns, and produces code shaped by different assumptions.1718Marc Baselga documented this after deploying Claude Code across an engineering19team; Ben Erez called it the "unexpected tax." Two developers asking their agents20to "follow our coding standards" receive different standards if their contexts21diverge. The fragmentation follows a predictable progression:2223 individual optimization -> silent divergence -> visible inconsistency24 -> coordination overhead2526The chapter's three solution architectures are not competing options but LAYERS27of one federated architecture (Table 6-4), mapped to organizational scale:2829| Scale | Layer | Tool | Mechanism |30|-------|-------|------|-----------|31| Team | Configuration as Code | APM (Meppiel) | versioned, composable skill/rule/prompt packages; `apm install` gives everyone the same base |32| Department | Shared Knowledge Layer | Nia Skills (Rakhmetzhanov) | a central indexed knowledge base any agent queries |33| Enterprise | Governance Control Plane | Runtime (Jarjoura) | business rules, constraints, ownership, decisions as infrastructure |3435The architecture is FEDERATED, not centralized: teams own domain-specific context36but inherit an organizational base encoding nonnegotiable standards (security37policies, architectural constraints, code-review requirements, compliance rules).38Jarjoura's diagnosis is the decisive one: "Context failure, not AI failure."39Agents amplify whatever structure they receive; incomplete or inconsistent40structure produces amplified ambiguity at the speed of token generation.4142## When to Use4344- Multiple developers or teams configure agents independently45- Code reviews reveal conflicting patterns produced by different agents46- Onboarding is hard because no single config represents team practice47- You need to enforce nonnegotiable standards (security/compliance) across teams48 while letting teams keep their domain-specific extensions4950Phrases that invoke this skill: "config drift", "our agents diverge", "context51governance", "federated config", "enforce the org base", "which governance52layer".5354## When NOT to Use5556- **A single developer's setup** — one config is coherent by definition; there is57 no drift to detect.58- **As a code linter** — it governs agent CONTEXT (settings, skills, rules), not59 source code. Lint code with a code linter.60- **As a secrets manager** — `secrets_in_env_only` is a policy KEY it enforces;61 it does not store or rotate secrets.62- **Where teams legitimately need different nonnegotiables** — then the setting is63 not actually nonnegotiable; move it to the negotiable set rather than forcing64 false uniformity.6566## Process6768| Step | Input | Action | Output | Verification |69|------|-------|--------|--------|--------------|70| 1 | Governance JSON (org_base + team_configs) | `lib.load_governance(path)` | Governance dict | Has `org_base` (with `nonnegotiable`) and `team_configs` |71| 2 | Team configs | `lib.detect_drift(configs)` | Settings that disagree + partial skills | A key with differing values across ≥2 teams is reported |72| 3 | Team configs | `lib.fragmentation_stage(configs)` | Stage on the four-stage progression | More drift → later stage (coordination overhead) |73| 4 | Org base + team configs | `lib.check_federation(org_base, teams)` | Per-team compliance + violations | A team overriding a nonnegotiable key is flagged non-compliant |74| 5 | Org base + one team | `lib.resolve_effective_config(org_base, team)` | Effective config with nonnegotiable keys locked to base | A team's override of a locked key is ignored; base value wins |75| 6 | Scale (team/department/enterprise) | `lib.recommend_layer(scale)` | The matching layer + tool + composition | Larger scales inherit the smaller layers beneath |7677## Rationalizations7879| Agent rationalization | Documented rebuttal |80|------------------------|---------------------|81| "Each developer's config working for them is fine." | It is fine individually and incoherent at the team level. Two agents given "follow our standards" produce different standards — the exact drift the chapter names. Individual coherence is not team coherence. |82| "Centralize all config in one file everyone shares." | The architecture is FEDERATED, not centralized. Teams own domain-specific context; forcing one file loses the backend/frontend/data specialization that made per-team config valuable. Inherit the base, extend locally. |83| "A team can override any setting it needs to." | Not the nonnegotiable ones. Security, architectural, and compliance keys are locked to the org base; a team disabling code review is a violation, not a preference. `resolve_effective_config` locks them by construction. |84| "Config drift is a people problem, not infrastructure." | Jarjoura: "Context failure, not AI failure." Agent config is shared infrastructure requiring versioning, testing, deployment, and monitoring — the same engineering discipline as any other shared infra. |85| "Pick one governance tool and use it everywhere." | The three layers map to scale and COMPOSE: Config-as-Code (team) inside Shared Knowledge (department) inside a Governance Control Plane (enterprise). One tool cannot span all three scales. |8687## Red Flags8889- **Zero drift reported across many independently-authored configs.** Either the90 configs are already governed (good) or the drift detector is not comparing the91 right setting keys.92- **A nonnegotiable violation reported as compliant.** The federation check is93 bypassed — a locked key must fail closed.94- **`resolve_effective_config` lets a team override a locked key.** The lock is95 inert; nonnegotiable keys must always resolve to the base value.96- **Fragmentation stuck at "individual optimization" despite obvious divergence.**97 The stage thresholds are miscalibrated for the number of configs.98- **CLI `--help` exits non-zero.** SKILL.md / CLI mismatch; multi-harness invariant broken.99100## Non-Negotiable Verification1011021. **Run the benchmark battery.**103 ```104 python cli.py benchmark105 ```106 Confirm drift is detected across teams, the fragmentation stage reflects it,107 and the seeded `rogue-frontend` nonnegotiable violation (disabling108 `code_review_required`) is caught.1091102. **Prove the lock holds in the effective config.**111 ```112 python cli.py effective rogue-frontend113 ```114 `code_review_required` MUST resolve to `True` (the base value) even though the115 team set it `False`.1161173. **Prove federation fails closed on the nonnegotiable.**118 ```119 python cli.py federate --json | python -c "import json,sys; d=json.load(sys.stdin); assert not d['all_compliant']"120 ```1211224. **Prove layer composition.**123 ```124 python cli.py layer enterprise125 ```126 Enterprise scale must inherit `[team, department, enterprise]`.127128## Security Posture129130- **Prompt injection.** Context configs are the agent's instructions; a131 compromised config is a direct injection vector. The nonnegotiable base is the132 defense — security-relevant keys (`secrets_in_env_only`, `code_review_required`)133 are locked and a team cannot silently disable them.134- **Data exfiltration.** No network calls in `lib.py`; governance is read from an135 explicit path. In production the org base is itself a versioned, reviewed136 artifact (the chapter's "agent config is shared infrastructure" point).137- **Privilege escalation.** `resolve_effective_config` locking nonnegotiable keys138 to the base is exactly the anti-escalation control — a team cannot grant itself139 a laxer security posture than the org mandates.140141## Composition142143- **Wraps** the whole tool-orchestration stack: `rag-mcp-tool-selection`,144 `mcp-gateway-two-meta-tools`, `hierarchical-orchestration-router` all assume a145 coherent context — this skill is the layer that keeps it coherent at team scale.146- **Pairs with** `hierarchical-orchestration-router` — hierarchical routing needs147 a coherent per-domain context to route into; this governs that context.148- **The nonnegotiable base** is the natural home for the security policies from149 `information-flow-control-gate` and the quality thresholds from150 `skill-quality-evaluator`.151- Mirrors an org-baseline-plus-local-extensions config-sync discipline: an152 org base every machine inherits, with local extensions composed on top.153154## Source Attribution155156Distilled from *Agentic GraphRAG* (O'Reilly), Chapter 6 — Tool Orchestration,157section "Context Governance: The Missing Layer in Tool Orchestration". Named158references:159160- Marc Baselga — documented config drift after team Claude Code deployment;161 Ben Erez — the "unexpected tax"162- Daniel Meppiel — APM (Agent Package Manager), Configuration as Code (team scale)163- Arlan Rakhmetzhanov — Nia Skills, Shared Knowledge Layer (department scale)164- Daniel Jarjoura — Runtime, Governance Control Plane (enterprise scale);165 "Context failure, not AI failure"
AnthonyAlcaraz