Reef orchestration
Governed model access
Make every agent step pass the same policy boundary
Reef model calls should use policy aliases and service identities designed for the workflow's risk and environment.
Workload identity
Issue separate keys for development and production Reef workloads. Scope model access, governance reads and operational management independently.
Capability contract
Declare the tools, schema, modalities, context and region required by the workflow. A policy route must fail closed if no eligible provider preserves them.
Budget and quotas
Apply per-workspace and per-service-key limits. Reef may stop a workflow on budget signals but cannot override Router capacity or policy denial.
One end-to-end deadline
Allocate time across Reef steps and Router attempts. Avoid nested retry loops in the SDK, Reef and product that multiply latency and cost.