Architecture · July 20, 2026 · 7 min read
Observed is not managed: the ownership model AI registries miss
A platform that records the prompt or model used in an execution has learned something important. It has not necessarily become the author, publisher, or runtime owner of that asset.
Many AI products place prompts, models, datasets, and providers in a single screen called a registry. That is a useful start, but it often hides the architectural question that matters most: what relationship does the platform actually have to each record?
When the answer is unclear, the interface quietly overclaims. A runtime reports that it used a prompt called claims-review-v7. The registry shows the prompt body, configuration, and a green status. Soon the organization assumes the registry is authoritative—even if the prompt was authored in another system, deployed by another team, and observed only after an evaluation ran.
That is not a cosmetic problem. It changes what operators believe, what integrations are safe to build, and what the system can honestly promise during a review.
One word, two different meanings
The word asset can mean at least two things.
It can mean an object owned by a platform: created there, versioned there, stored there, and subject to lifecycle rules there. A dataset uploaded to Kavach fits this model. Kavach accepts the bytes, validates them, calculates the checksum, writes an immutable artifact, and registers the version. The control plane has a direct responsibility for that record.
Or it can mean a fact reported by another system: the model revision a service invoked, the runtime parameters it used, or the prompt template it applied. Kavach should preserve that fact because it is evidence. But evidence is not the same thing as control.
A governed catalog should say whether it owns an asset or merely knows that the asset was used.
What managed means
A managed asset has a lifecycle that Kavach can truthfully enforce. It may have immutable content, checksums, a storage location, and explicit version state. Dataset registration is the clearest example: the registry is responsible for recording the exact artifact that a future experiment or replay should use.
Managed does not mean the rest of the organization stops owning the business meaning of a dataset. It means Kavach owns the governance record and artifact contract it created. Evaluation providers are managed in a related way: Kavach owns the adapter descriptor, capability contract, and supported metrics even when the provider itself is an external library or service.
What observed means
An observed asset begins with an execution fact. A producer reports a source system, optional source reference, identity, version, and the configuration it actually used. Kavach records that immutable evidence and projects it into lineage. It does not rewrite the configuration, publish it to a runtime, or pretend that it owns the upstream authoring workflow.
This model is especially important for prompts. Some organizations are comfortable providing the template body; others allow only metadata and a content hash to cross the runtime boundary. Both cases can produce a useful observed prompt record. What changes is not the identity of the evidence, but the visibility of its sensitive content.
Observed model records follow the same rule. The provider, model name, revision, context window, and parameters are runtime facts. A catalog can make them reviewable without claiming that it configured the provider or can deploy that revision on demand.
Why this makes integrations safer
Once ownership is explicit, the integration contract becomes much simpler. A runtime or evaluator can submit generic evidence over REST. It does not need to adopt a specific prompt editor, export its entire deployment configuration, or grant the control plane permission to modify production behavior.
The producer keeps its own lifecycle. Kavach keeps its evidence model. The two systems meet at a narrow boundary: stable identity, version, source provenance, optional protected content, and exact observed configuration. That boundary is easier to secure, easier to test, and less likely to collapse when the runtime changes frameworks.
It also leaves room for enterprise synchronization later. An external registry connector can create an Imported record without changing the core model. The UI, ontology, and downstream references still work because provenance tells operators how the record arrived.
Trust is precise language
Governance systems deal in claims: this version was evaluated, this policy was applied, this decision was supported by these inputs. The system should be equally precise about the origin of those inputs. A badge that says Observed is not decorative. It tells a reviewer where to look when the question changes from “what did Kavach record?” to “who owns the source of truth?”
That is the practical reason to keep managed and observed assets separate. It makes ownership visible before an audit, incident, or model change turns ambiguity into operational work.